Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20230831-en - resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system - submitted
05/09/2023, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AA-021 market research.exe
Resource
win7-20230831-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AA-021 market research.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target AA-021 market research.exe
- Size 392KB
- Sample230905-blm6yscc6s
- SHA256 1b29005d1fa110dfb5b924c879e64d7d4cce8af163f9e6853e4bbda2c298acf0
- MD5 b8e7041651b0e6d50a5343b31d1edf9e
- SHA1 decfa0a35fff7ed61d75598dbc8a9cebc2220297
- SHA512 cbb2b01e8cfa0d39d7ad74120b2b20c0a7f7f9e5aaac8658c0ca10cb529271f97cb61a646ea0e79c16dad6f24924b80cb1ffd8533bbb9c3d07f3557468c0443b
- SSDEEP 12288:/Y1+C7K+7kGPPtDQmPxgmXGVe7glP+w7Ki:/Y1+V+n3BQRwGVWglmw7Ki
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Control Panel\International\Geo\Nation jtquai.exe - Executes dropped EXE 2 IoCs
pid Process 4440 jtquai.exe 4928 jtquai.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4440 set thread context of 4928 4440 jtquai.exe 87 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe 4928 jtquai.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4440 jtquai.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4928 jtquai.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3064 wrote to memory of 4440 3064 AA-021 market research.exe 84 PID 3064 wrote to memory of 4440 3064 AA-021 market research.exe 84 PID 3064 wrote to memory of 4440 3064 AA-021 market research.exe 84 PID 4440 wrote to memory of 4928 4440 jtquai.exe 87 PID 4440 wrote to memory of 4928 4440 jtquai.exe 87 PID 4440 wrote to memory of 4928 4440 jtquai.exe 87 PID 4440 wrote to memory of 4928 4440 jtquai.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\AA-021 market research.exe"C:\Users\Admin\AppData\Local\Temp\AA-021 market research.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\jtquai.exe"C:\Users\Admin\AppData\Local\Temp\jtquai.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\jtquai.exe"C:\Users\Admin\AppData\Local\Temp\jtquai.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dpwyahfab.lkc
- Size 231KB
- SHA256 85722a03e8159579be31f2cba8930ec7830db463123a3ea14598ad48aab9d74f
- MD5 51e23ffc06dd6f7df2a7d7b1aec36722
- SHA1 d82bb99c00ce35bc696de81820606309b7d37aad
- SHA512 807340a164a9b34bdaf707e9ac05668085e2b81ba8b5394bb1f805e9035487a6ad972286e1a50c958d9695b2f1de61a6fc6080abf1cc2e5c4e408458b08c0ffd
- SSDEEP 3072:eokNeEYS15Q1fPmO7nM6M4CvR4F7nIA1LmVx4UITCbDkL6rzua+cUix:eTeEYS129z8R49nIOyDl9bDkLKrJx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jtquai.exe
- Size 275KB
- SHA256 4efcdc51e82b9e6241e65e28e539379a34877650a9807d5e486d04815cd9472b
- MD5 c969d837546bf40999ad9fdcc10ab1a6
- SHA1 5f2ef43813cae3d788f88272b282b715b37a867c
- SHA512 43591eb74b1fa5a9906f3544ec4bf387910a86fcc4b351c42425446856d330d7ed38b6eea85bb6581e43455a228f7cd15be4b15eea3cf4c83327beb21f1acb7a
- SSDEEP 6144:OswogpGTSqymyzMqESCvPlvPQ3WAOrofvk0y:OsHLyz6vNCW9IXy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jtquai.exe
- Size 275KB
- SHA256 4efcdc51e82b9e6241e65e28e539379a34877650a9807d5e486d04815cd9472b
- MD5 c969d837546bf40999ad9fdcc10ab1a6
- SHA1 5f2ef43813cae3d788f88272b282b715b37a867c
- SHA512 43591eb74b1fa5a9906f3544ec4bf387910a86fcc4b351c42425446856d330d7ed38b6eea85bb6581e43455a228f7cd15be4b15eea3cf4c83327beb21f1acb7a
- SSDEEP 6144:OswogpGTSqymyzMqESCvPlvPQ3WAOrofvk0y:OsHLyz6vNCW9IXy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jtquai.exe
- Size 275KB
- SHA256 4efcdc51e82b9e6241e65e28e539379a34877650a9807d5e486d04815cd9472b
- MD5 c969d837546bf40999ad9fdcc10ab1a6
- SHA1 5f2ef43813cae3d788f88272b282b715b37a867c
- SHA512 43591eb74b1fa5a9906f3544ec4bf387910a86fcc4b351c42425446856d330d7ed38b6eea85bb6581e43455a228f7cd15be4b15eea3cf4c83327beb21f1acb7a
- SSDEEP 6144:OswogpGTSqymyzMqESCvPlvPQ3WAOrofvk0y:OsHLyz6vNCW9IXy
- MD5 SHA1 SHA512 SSDEEP