aa42ba56492cc27644fe8c2b2d474e4fe762a49e284dc391ff5a9807ce0b5b53

General

Target

Annual Leave and Salary Memo_PDF.exe
Size

352KB
MD5

5ac38c0411769fc70fde438d5d74ceeb
SHA1

4f3619eb37373854bde4f1a3e510e5c525f971c7
SHA256

8e06e30fe6a9c4f64a09da567c0a6d2f01b49622f535122736d1dd7177b7f9be
SHA512

8d46c0b9fbfe711fcc95cbfe723ec864b1366bcc06cdfd6986126fbc4e2a013a708bface78e3fa023b084abb965cf0a6184f4192f13cc8ec87b28028db886b10
SSDEEP

6144:/Ya6evNxhBqtTbVirSLYsL3Y3A/IIHVAg2+C+qpWFtsDUV+ONMI3Uv/rr37FnqTZ:/YIvN/Bqr6szd/IIHuQVFFtscr3Yr02E

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Control Panel\International\Geo\Nation	jjoajzkd.exe

Executes dropped EXE 2 IoCs

pid	Process
2140	jjoajzkd.exe
2576	jjoajzkd.exe

Loads dropped DLL 2 IoCs

pid	Process
2968	Annual Leave and Salary Memo_PDF.exe
2140	jjoajzkd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2576	2140	jjoajzkd.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe
2576	jjoajzkd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2140	jjoajzkd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	jjoajzkd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2140	2968	Annual Leave and Salary Memo_PDF.exe	28
PID 2968 wrote to memory of 2140	2968	Annual Leave and Salary Memo_PDF.exe	28
PID 2968 wrote to memory of 2140	2968	Annual Leave and Salary Memo_PDF.exe	28
PID 2968 wrote to memory of 2140	2968	Annual Leave and Salary Memo_PDF.exe	28
PID 2140 wrote to memory of 2576	2140	jjoajzkd.exe	29
PID 2140 wrote to memory of 2576	2140	jjoajzkd.exe	29
PID 2140 wrote to memory of 2576	2140	jjoajzkd.exe	29
PID 2140 wrote to memory of 2576	2140	jjoajzkd.exe	29
PID 2140 wrote to memory of 2576	2140	jjoajzkd.exe	29

C:\Users\Admin\AppData\Local\Temp\Annual Leave and Salary Memo_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Annual Leave and Salary Memo_PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe
  "C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe
    "C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe

Filesize
180KB

MD5
4e90643c232b2c88ac72958322b873d5

SHA1
f040959d3acb90bd547d795a6f582395de08a18f

SHA256
8370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b

SHA512
a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe

Filesize
180KB

MD5
4e90643c232b2c88ac72958322b873d5

SHA1
f040959d3acb90bd547d795a6f582395de08a18f

SHA256
8370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b

SHA512
a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe

Filesize
180KB

MD5
4e90643c232b2c88ac72958322b873d5

SHA1
f040959d3acb90bd547d795a6f582395de08a18f

SHA256
8370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b

SHA512
a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\uamikkj.bb

Filesize
232KB

MD5
ae41c8abe785aa8d353308326f65436e

SHA1
90d12631494730b8baf70aa397af1a1ae5cf5107

SHA256
c07d9c00dd283e9cda0826ea7c620f1a7fe31abf94e2385054b5e6e3e70762be

SHA512
f70c65498fee0c9d3e44443e981e01d0f0ae5cfabb158d70718b084e57bc56ec8986dfec540bcaa1aec227e47db1bc8482ef2748a46d2ec897ebe55f0384a1c7

Download Submit
\Users\Admin\AppData\Local\Temp\jjoajzkd.exe

Filesize
180KB

MD5
4e90643c232b2c88ac72958322b873d5

SHA1
f040959d3acb90bd547d795a6f582395de08a18f

SHA256
8370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b

SHA512
a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66

Download Submit
\Users\Admin\AppData\Local\Temp\jjoajzkd.exe

Filesize
180KB

MD5
4e90643c232b2c88ac72958322b873d5

SHA1
f040959d3acb90bd547d795a6f582395de08a18f

SHA256
8370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b

SHA512
a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66

Download Submit
memory/2140-6-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2576-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2576-12-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2576-14-0x0000000000780000-0x0000000000A83000-memory.dmp

Filesize
3.0MB

Download
memory/2576-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing