4aeb1dd860b8437a4ac3adc63516d33634613f527b266bd205380bf9c399d287

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jssetup_100100507_4002809 (1).exe
Size

604KB
MD5

0379e70afd7d57a717a167aba8f2bf18
SHA1

02ac6d57f1eb69553ed5ec286af5d170e21fad7e
SHA256

4aeb1dd860b8437a4ac3adc63516d33634613f527b266bd205380bf9c399d287
SHA512

72ae74cedf89d7cae83d72e52a58ec7a4aac8313a4e5b24743f6cceea1551fa9d9922bceeac57ad2a95e153f9bcf9df9f5c91e275422106de1f56394951f71b8
SSDEEP

12288:fx5da32YbO8Sd/ysgErVyUwf7JU3kfMw1K6vt4eGejjcb33BY:xO2uYj3kfi6KUjjcbnBY

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1288	Explorer.EXE

Loads dropped DLL 1 IoCs

pid	Process
2584	jssetup_100100507_4002809 (1).exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	jssetup_100100507_4002809 (1).exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Launcher	jssetup_100100507_4002809 (1).exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	jssetup_100100507_4002809 (1).exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	jssetup_100100507_4002809 (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Explorer.EXE
File opened for modification	\??\PhysicalDrive0	jssetup_100100507_4002809 (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 1288	2584	jssetup_100100507_4002809 (1).exe	14

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	jssetup_100100507_4002809 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	jssetup_100100507_4002809 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	jssetup_100100507_4002809 (1).exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2584	jssetup_100100507_4002809 (1).exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe
2584	jssetup_100100507_4002809 (1).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1288	2584	jssetup_100100507_4002809 (1).exe	14
PID 2584 wrote to memory of 1288	2584	jssetup_100100507_4002809 (1).exe	14
PID 2584 wrote to memory of 1288	2584	jssetup_100100507_4002809 (1).exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1288
- C:\Users\Admin\AppData\Local\Temp\jssetup_100100507_4002809 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\jssetup_100100507_4002809 (1).exe"
  2⤵
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9544.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\pRyOtSyVgBuWmLtI64.tmp

Filesize
199KB

MD5
b323860fd7f76d393c4d509370364df6

SHA1
e301a850d3f5cfd964aca42cf6ef777992df4c08

SHA256
b515afde265aaa73fc5dfd129d212edf823efbb77b71a4b59e9350f3e8b57877

SHA512
adc8430c4b27faeb4ca4bfc32d993700f7c204c832a3f3332dc75510e6aa84a8ecddae504488a992441cfa7c2f1032cc8bf0572b6ea68ed195d9ea4203451a51

Download Submit
\Users\Admin\AppData\Local\Temp\jArMpBaEaEaMqXdC\360ini.dll

Filesize
4.3MB

MD5
fd33b0dfbc35f3da4b7425b9b196d1cb

SHA1
aa4f1fe0f9ebff8c2b4349228666226d98bce68b

SHA256
a5c4a7521cb743b6d8fe4adf45797e3f99fa61cf65fdf4f3d1147988b8c5fb1f

SHA512
722c16b2541611cb0cb48c7447452c32441a3d5403f39d809ad500be6c7e0cf47820822fd2386878a1f44487a6909457943192013d72f474995e155320a74abe

Download Submit
\Users\Admin\AppData\Local\Temp\pRyOtSyVgBuWmLtI64.tmp

Filesize
199KB

MD5
b323860fd7f76d393c4d509370364df6

SHA1
e301a850d3f5cfd964aca42cf6ef777992df4c08

SHA256
b515afde265aaa73fc5dfd129d212edf823efbb77b71a4b59e9350f3e8b57877

SHA512
adc8430c4b27faeb4ca4bfc32d993700f7c204c832a3f3332dc75510e6aa84a8ecddae504488a992441cfa7c2f1032cc8bf0572b6ea68ed195d9ea4203451a51

Download Submit
memory/1288-109-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/1288-110-0x0000000003920000-0x0000000003930000-memory.dmp

Filesize
64KB

Download
memory/2584-0-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download