a0a09bade10bed15a92e82ecf5d785d93d6db6645c0166aa823e80119e968d45

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee98ce0a1f6556exe_JC.exe
Size

2.6MB
MD5

ee98ce0a1f655660b39e31b8ca186988
SHA1

dea566a2215d9a2d16df6e646ec6e0c8d72c79e9
SHA256

a0a09bade10bed15a92e82ecf5d785d93d6db6645c0166aa823e80119e968d45
SHA512

c99fe1e76265964420c9a828c9ab089863f597880db27062ab30972b5a8fab1e78b2edc317f4204d516b0a6e6767a76b854b2cdd11655b4876f134245ba27fdd
SSDEEP

24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LX:tl1vqjdPQRw/D4mizA0dizLrB51vW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid process

2028 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	autoit_exe
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	autoit_exe

Drops file in Program Files directory 1 IoCs

Processes:

ee98ce0a1f6556exe_JC.exe

description ioc process

File created C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe ee98ce0a1f6556exe_JC.exe

description	ioc	process
File created	C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe	ee98ce0a1f6556exe_JC.exe

Drops file in Windows directory 4 IoCs

Processes:

ee98ce0a1f6556exe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	ee98ce0a1f6556exe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	ee98ce0a1f6556exe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	ee98ce0a1f6556exe_JC.exe
File created	C:\WINDOWS\Media\ActiveX.ocx	ee98ce0a1f6556exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 3 IoCs

Processes:

ee98ce0a1f6556exe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	ee98ce0a1f6556exe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	ee98ce0a1f6556exe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	ee98ce0a1f6556exe_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ee98ce0a1f6556exe_JC.exe

pid process

2408 ee98ce0a1f6556exe_JC.exe

pid	process
2408	ee98ce0a1f6556exe_JC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid	process
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid	process
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

pid process

2028 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
2028 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ee98ce0a1f6556exe_JC.exe

description	pid	process	target process
PID 2408 wrote to memory of 2028	2408	ee98ce0a1f6556exe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 2408 wrote to memory of 2028	2408	ee98ce0a1f6556exe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 2408 wrote to memory of 2028	2408	ee98ce0a1f6556exe_JC.exe	64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
PID 2408 wrote to memory of 2092	2408	ee98ce0a1f6556exe_JC.exe	regsvr32.exe
PID 2408 wrote to memory of 2092	2408	ee98ce0a1f6556exe_JC.exe	regsvr32.exe
PID 2408 wrote to memory of 2092	2408	ee98ce0a1f6556exe_JC.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\ee98ce0a1f6556exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ee98ce0a1f6556exe_JC.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
  "C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
  2⤵
  PID:2092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Filesize
642KB

MD5
d871f2c4088b8b4044a06352378e5f47

SHA1
1ac52a4fa15aaee20307c475ff0ef95351418074

SHA256
bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa

SHA512
294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68

Download Submit
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

Filesize
642KB

MD5
d871f2c4088b8b4044a06352378e5f47

SHA1
1ac52a4fa15aaee20307c475ff0ef95351418074

SHA256
bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa

SHA512
294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68

Download Submit
C:\WINDOWS\Media\ActiveX.ocx

Filesize
12B

MD5
aa1b2c579cdcd1361c810ee59441327a

SHA1
b4a029c5294bc984a64edad1dc47e99d587e43aa

SHA256
eb9fb24c9b40ef97ef8f96b504261077fb75e32f94a9450dc755e07ebff08ba9

SHA512
b184835b2028325c3a5f7e5b2555a206a9825d230d835801f89b112a618ee03df16851375089d34b583276a8580236653e3e90cdb1f12b043dcae6f7464e0fde

Download Submit