Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abf01f37f3233a446f1ba203d2c99e0f_JC.exe
Resource
win7-20230831-en
windows7-x64
25 signatures
150 seconds
General
-
Target
abf01f37f3233a446f1ba203d2c99e0f_JC.exe
-
Size
1.2MB
-
MD5
abf01f37f3233a446f1ba203d2c99e0f
-
SHA1
3fa185e11ee45123b113f67b2433217067724668
-
SHA256
b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
-
SHA512
2e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
SSDEEP
24576:IMrbrn/mG9Pwrn/POzMQGEvGEPapJoedR5inu3i6ZTdDiUSgwt9faL+Wdi3oBMcX:IMHrn/X9Pwrn/POzMQGEvGE2linu3i6Z
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "Userinit,\"C:\\Program Files\\Windows Media Player\\a\\b\\9\\d\\b\\5\\f\\a\\1\\5\\6\\2\\e\\c\\8\\f\\5\\d\\6\\3\\2\\c\\b\\5\\c\\b\\2\\6\\9\\3\\a\\4\\autorun.inf\\svchost.exe¡¡\"" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "Userinit,\"C:\\Program Files\\Windows Media Player\\a\\b\\9\\d\\b\\5\\f\\a\\1\\5\\6\\2\\e\\c\\8\\f\\5\\d\\6\\3\\2\\c\\b\\5\\c\\b\\2\\6\\9\\3\\a\\4\\autorun.inf\\svchost.exe¡¡\"" svchost.exe¡¡ -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.exe¡¡ -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 1564 svchost.exe¡¡ -
Loads dropped DLL 7 IoCs
pid Process 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ -
resource yara_rule behavioral1/memory/664-9-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-10-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-19-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-20-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-23-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-26-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-30-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-34-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-37-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-38-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-43-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-49-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-54-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-57-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-64-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-67-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-146-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/664-210-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification \??\PhysicalDrive0 svchost.exe¡¡ -
Drops autorun.inf file 1 TTPs 35 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Program Files\Windows Media Player\a\b\9\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf\ÎļþÃâÒß abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File created C:\Program Files\Windows Media Player\a\b\9\d\b\autorun.inf\desktop.ini abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\autorun.inf abf01f37f3233a446f1ba203d2c99e0f_JC.exe File opened for modification C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\autorun.inf\ÎļþÃâÒß..\ abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2580 taskkill.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe¡¡\ = "exefile" abf01f37f3233a446f1ba203d2c99e0f_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe¡¡ abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 2580 taskkill.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe Token: SeDebugPrivilege 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ 1564 svchost.exe¡¡ -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 664 wrote to memory of 1112 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 2 PID 664 wrote to memory of 1180 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 11 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 1236 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 10 PID 1216 wrote to memory of 2580 1216 cmd.exe 32 PID 1216 wrote to memory of 2580 1216 cmd.exe 32 PID 1216 wrote to memory of 2580 1216 cmd.exe 32 PID 1216 wrote to memory of 2580 1216 cmd.exe 32 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 664 wrote to memory of 1112 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 2 PID 664 wrote to memory of 1180 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 11 PID 664 wrote to memory of 1236 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 10 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 1216 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 30 PID 664 wrote to memory of 2952 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 31 PID 664 wrote to memory of 2580 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 32 PID 664 wrote to memory of 2580 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 32 PID 664 wrote to memory of 1564 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 34 PID 664 wrote to memory of 1564 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 34 PID 664 wrote to memory of 1564 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 34 PID 664 wrote to memory of 1564 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 34 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 664 wrote to memory of 1732 664 abf01f37f3233a446f1ba203d2c99e0f_JC.exe 33 PID 1732 wrote to memory of 1956 1732 cmd.exe 36 PID 1732 wrote to memory of 1956 1732 cmd.exe 36 PID 1732 wrote to memory of 1956 1732 cmd.exe 36 PID 1732 wrote to memory of 1956 1732 cmd.exe 36 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" abf01f37f3233a446f1ba203d2c99e0f_JC.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\abf01f37f3233a446f1ba203d2c99e0f_JC.exe"C:\Users\Admin\AppData\Local\Temp\abf01f37f3233a446f1ba203d2c99e0f_JC.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:664 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CQ.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im qq.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\temp.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Media Player\a" /d everyone /e4⤵PID:1956
-
-
-
C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡"C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡" pid 664"C:\Users\Admin\AppData\Local\Temp\abf01f37f3233a446f1ba203d2c99e0f_JC.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "751195563688236382-806882725960748574-6940158781223745374778674875574495563"1⤵PID:2952
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
7Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
Filesize1.2MB
MD5abf01f37f3233a446f1ba203d2c99e0f
SHA13fa185e11ee45123b113f67b2433217067724668
SHA256b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
SHA5122e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
Filesize1.2MB
MD5abf01f37f3233a446f1ba203d2c99e0f
SHA13fa185e11ee45123b113f67b2433217067724668
SHA256b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
SHA5122e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
Filesize1.2MB
MD5abf01f37f3233a446f1ba203d2c99e0f
SHA13fa185e11ee45123b113f67b2433217067724668
SHA256b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
SHA5122e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
30B
MD5458d6a0f8398f6fa8bda7bb2ba5be353
SHA1eec02a1cf5047cee3d4dee32ef13498c49a61154
SHA25666142298d915314ddb48b417e96b48936e71a190d8f7cd8ae5a053cbe2746ddc
SHA512c4fad6cafa4b17da18f5beceb65f91414c9fa0774c99caeadc87bc44f5faee6425208c78f6f111bec71b2e0cf58922c4bb62a0e3247b2af7699113a76c11c730
-
Filesize
30B
MD5458d6a0f8398f6fa8bda7bb2ba5be353
SHA1eec02a1cf5047cee3d4dee32ef13498c49a61154
SHA25666142298d915314ddb48b417e96b48936e71a190d8f7cd8ae5a053cbe2746ddc
SHA512c4fad6cafa4b17da18f5beceb65f91414c9fa0774c99caeadc87bc44f5faee6425208c78f6f111bec71b2e0cf58922c4bb62a0e3247b2af7699113a76c11c730
-
Filesize
28KB
MD5992322b55f2684fe4c83b8e94dd54adb
SHA10990c5d0da44f3dfa45208c8d7d6ca27614dc165
SHA256d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead
SHA512471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b
-
Filesize
332KB
MD53102c454a9543e58fe3ad5f783f5a690
SHA1dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9
SHA256039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9
SHA5125b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807
-
Filesize
192KB
MD5c1180974dd8a7c6d9f8fcc13096b4f7a
SHA19d50021334248bf0c752b3ed34deed48325da05c
SHA2565b1ff0cabb2384f4b6385c1acce1d5e3a9d7b8e0403e2224cd1ab9722a599d3d
SHA512c8b938bf172b9d2ccfaea34ff7cfddc9eaab8a9416a07e458bd34dfed2ea18de66d23dbaa9f15c2faf1009e00a8dfca3168ab41f02ef28e97c9197c3ca6943e9
-
Filesize
1.0MB
MD54b30dbe1a79b2b7572ff637cb3765ced
SHA1b08eba0e9bdb62d426db8d2b3d451152a56f79a1
SHA2564208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d
SHA51240e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce
-
Filesize
72B
MD528b4bca46f12e840a196a027b05b1675
SHA13d1c1c0ac44bf8db45d579287dbd0ecc26ddcbfa
SHA256aacf79a3eb763b78eccfe7ef16c9b4d80aa3bd07e70b2a87f6ba551bd78ea808
SHA51222fe6b9a3b36b77b4ac39d2a96fd5a944bf756b885318f6410e1c57f79a27fa65aba1ec6e24fa7ab318330de24ab86b9327ed770480fe7c1188483a0033a207f
-
Filesize
72B
MD528b4bca46f12e840a196a027b05b1675
SHA13d1c1c0ac44bf8db45d579287dbd0ecc26ddcbfa
SHA256aacf79a3eb763b78eccfe7ef16c9b4d80aa3bd07e70b2a87f6ba551bd78ea808
SHA51222fe6b9a3b36b77b4ac39d2a96fd5a944bf756b885318f6410e1c57f79a27fa65aba1ec6e24fa7ab318330de24ab86b9327ed770480fe7c1188483a0033a207f
-
\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
Filesize1.2MB
MD5abf01f37f3233a446f1ba203d2c99e0f
SHA13fa185e11ee45123b113f67b2433217067724668
SHA256b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
SHA5122e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
Filesize1.2MB
MD5abf01f37f3233a446f1ba203d2c99e0f
SHA13fa185e11ee45123b113f67b2433217067724668
SHA256b75a80fc32b8abfe0633d0616873e35beb70e59caaf06b54f4563fba2e908a74
SHA5122e3ced8e98c68a36944b6fb273c0839739b2c9e084ae6ea4c5b8f34d0ee2f179d1003356efb9ad264e71646d4ed5ccf78ccdc980a745752be2a70f0ea06cde71
-
Filesize
28KB
MD5992322b55f2684fe4c83b8e94dd54adb
SHA10990c5d0da44f3dfa45208c8d7d6ca27614dc165
SHA256d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead
SHA512471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b
-
Filesize
28KB
MD5992322b55f2684fe4c83b8e94dd54adb
SHA10990c5d0da44f3dfa45208c8d7d6ca27614dc165
SHA256d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead
SHA512471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b
-
Filesize
332KB
MD53102c454a9543e58fe3ad5f783f5a690
SHA1dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9
SHA256039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9
SHA5125b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807
-
Filesize
1.0MB
MD54b30dbe1a79b2b7572ff637cb3765ced
SHA1b08eba0e9bdb62d426db8d2b3d451152a56f79a1
SHA2564208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d
SHA51240e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce
-
Filesize
1.0MB
MD54b30dbe1a79b2b7572ff637cb3765ced
SHA1b08eba0e9bdb62d426db8d2b3d451152a56f79a1
SHA2564208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d
SHA51240e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce