90e0f2993721b9b1f69ea3e2e93a162f8cc4a9c40563551bfb82946ae74dfa55

General

Target

24ae8609481a44exeexe_JC.exe
Size

2.6MB
MD5

24ae8609481a44eaa695fbb493b5fa73
SHA1

1f04c7b75f42897c4b3004335e237fb2061a47fb
SHA256

90e0f2993721b9b1f69ea3e2e93a162f8cc4a9c40563551bfb82946ae74dfa55
SHA512

9bb19bf3939a6a9d2911791f7b45e670db744cbf15b74a45db585d017d3d0638d735c0b2c573aeeaf9928e9776a8fa9dc99a48fcc3d752737f769a08e3e6c1b4
SSDEEP

24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6L3:tl1vqjdPQRw/D4mizA0dizLrB51vu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid process

1460 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	autoit_exe
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	autoit_exe

Drops file in Program Files directory 1 IoCs

Processes:

24ae8609481a44exeexe_JC.exe

description ioc process

File created C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 24ae8609481a44exeexe_JC.exe

description	ioc	process
File created	C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	24ae8609481a44exeexe_JC.exe

Drops file in Windows directory 4 IoCs

Processes:

24ae8609481a44exeexe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\ActiveX.ocx	24ae8609481a44exeexe_JC.exe
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	24ae8609481a44exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	24ae8609481a44exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	24ae8609481a44exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 3 IoCs

Processes:

24ae8609481a44exeexe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	24ae8609481a44exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	24ae8609481a44exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	24ae8609481a44exeexe_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

24ae8609481a44exeexe_JC.exe

pid process

772 24ae8609481a44exeexe_JC.exe

pid	process
772	24ae8609481a44exeexe_JC.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid	process
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid	process
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid process

1460 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1460 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

24ae8609481a44exeexe_JC.exe

description	pid	process	target process
PID 772 wrote to memory of 1460	772	24ae8609481a44exeexe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 772 wrote to memory of 1460	772	24ae8609481a44exeexe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 772 wrote to memory of 1460	772	24ae8609481a44exeexe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 772 wrote to memory of 3924	772	24ae8609481a44exeexe_JC.exe	regsvr32.exe
PID 772 wrote to memory of 3924	772	24ae8609481a44exeexe_JC.exe	regsvr32.exe
PID 772 wrote to memory of 3924	772	24ae8609481a44exeexe_JC.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\24ae8609481a44exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\24ae8609481a44exeexe_JC.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
  "C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1460
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
  2⤵
  PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Filesize
642KB

MD5
d871f2c4088b8b4044a06352378e5f47

SHA1
1ac52a4fa15aaee20307c475ff0ef95351418074

SHA256
bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa

SHA512
294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68

Download Submit
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Filesize
642KB

MD5
d871f2c4088b8b4044a06352378e5f47

SHA1
1ac52a4fa15aaee20307c475ff0ef95351418074

SHA256
bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa

SHA512
294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68

Download Submit
C:\WINDOWS\Media\ActiveX.ocx

Filesize
12B

MD5
98477d7f4862984007ffae336026c96f

SHA1
d2ba7a96df93152eaaf8151b6c61a8c03fef16f6

SHA256
bc58dd5501d7f1a4bad24a85de09db6baadc2e32e19c8879dae454e0e0f26d06

SHA512
26474f94976a8c3cdae0fa2a70bc5838941d0950410a9a2020d89a645ed09c07d8e5c6f66de5b893e44e110e3a996d991032b9d6171f9eaa845602c14c465206

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads