Overview

overview

8

Static

static

1

jssetup_10...1).exe

windows7-x64

8

jssetup_10...1).exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2023 05:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    jssetup_100100507_4002809 (1).exe

  • Size

    604KB

  • MD5

    0379e70afd7d57a717a167aba8f2bf18

  • SHA1

    02ac6d57f1eb69553ed5ec286af5d170e21fad7e

  • SHA256

    4aeb1dd860b8437a4ac3adc63516d33634613f527b266bd205380bf9c399d287

  • SHA512

    72ae74cedf89d7cae83d72e52a58ec7a4aac8313a4e5b24743f6cceea1551fa9d9922bceeac57ad2a95e153f9bcf9df9f5c91e275422106de1f56394951f71b8

  • SSDEEP

    12288:fx5da32YbO8Sd/ysgErVyUwf7JU3kfMw1K6vt4eGejjcb33BY:xO2uYj3kfi6KUjjcbnBY

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\jssetup_100100507_4002809 (1).exe
      "C:\Users\Admin\AppData\Local\Temp\jssetup_100100507_4002809 (1).exe"
      2⤵
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\qVoXaClZnGqWaJyM\360ini.dll
    Filesize

    4.3MB

    MD5

    fd33b0dfbc35f3da4b7425b9b196d1cb

    SHA1

    aa4f1fe0f9ebff8c2b4349228666226d98bce68b

    SHA256

    a5c4a7521cb743b6d8fe4adf45797e3f99fa61cf65fdf4f3d1147988b8c5fb1f

    SHA512

    722c16b2541611cb0cb48c7447452c32441a3d5403f39d809ad500be6c7e0cf47820822fd2386878a1f44487a6909457943192013d72f474995e155320a74abe

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\qVoXaClZnGqWaJyM\360ini.dll
    Filesize

    4.3MB

    MD5

    fd33b0dfbc35f3da4b7425b9b196d1cb

    SHA1

    aa4f1fe0f9ebff8c2b4349228666226d98bce68b

    SHA256

    a5c4a7521cb743b6d8fe4adf45797e3f99fa61cf65fdf4f3d1147988b8c5fb1f

    SHA512

    722c16b2541611cb0cb48c7447452c32441a3d5403f39d809ad500be6c7e0cf47820822fd2386878a1f44487a6909457943192013d72f474995e155320a74abe

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\xJaZaEwTyPoQxTyM64.tmp
    Filesize

    199KB

    MD5

    b323860fd7f76d393c4d509370364df6

    SHA1

    e301a850d3f5cfd964aca42cf6ef777992df4c08

    SHA256

    b515afde265aaa73fc5dfd129d212edf823efbb77b71a4b59e9350f3e8b57877

    SHA512

    adc8430c4b27faeb4ca4bfc32d993700f7c204c832a3f3332dc75510e6aa84a8ecddae504488a992441cfa7c2f1032cc8bf0572b6ea68ed195d9ea4203451a51

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\xJaZaEwTyPoQxTyM64.tmp
    Filesize

    199KB

    MD5

    b323860fd7f76d393c4d509370364df6

    SHA1

    e301a850d3f5cfd964aca42cf6ef777992df4c08

    SHA256

    b515afde265aaa73fc5dfd129d212edf823efbb77b71a4b59e9350f3e8b57877

    SHA512

    adc8430c4b27faeb4ca4bfc32d993700f7c204c832a3f3332dc75510e6aa84a8ecddae504488a992441cfa7c2f1032cc8bf0572b6ea68ed195d9ea4203451a51

    Download Submit

  • memory/1208-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3172-62-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3172-63-0x00000000026B0000-0x00000000026C0000-memory.dmp

    Filesize

    64KB

    Download