b14dc65ddee82651f45abcf6092da6318e936b071aa93fc955a3f930aea15beb

Analysis

max time kernel
155s
max time network
175s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
Size

60KB
MD5

a818d6834e4d351d6fa8a2348b73f4ee
SHA1

b66018d1f8829b256473a6c07eabe6fbbadcd034
SHA256

b14dc65ddee82651f45abcf6092da6318e936b071aa93fc955a3f930aea15beb
SHA512

7e937a09aeaa440ba24e72bc54a52122ed3990b12758bc3d5afe47fa1983ac71f257ed96764bb4735031f0eaf9daaa15832e3fd649d1f97b56457db1369aacac
SSDEEP

384:+5rDuuOFpEauMLfQDb2pproT/z4o1GJE6Al6zVyXeTLhrqNNNNLwwwwgn777l:MDcpEBMLfQcubtGE96ByXeTLdb

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2972	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	jaohost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\jaohost.exe	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
File opened for modification	C:\Windows\Debug\jaohost.exe	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
File opened for modification	C:\Windows\Debug\jaohost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2972	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	28
PID 2872 wrote to memory of 2972	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	28
PID 2872 wrote to memory of 2972	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	28
PID 2872 wrote to memory of 2972	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	28
PID 2872 wrote to memory of 2616	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	33
PID 2872 wrote to memory of 2616	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	33
PID 2872 wrote to memory of 2616	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	33
PID 2872 wrote to memory of 2616	2872	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a818d6834e4d351d6fa8a2348b73f4ee_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\jaohost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A818D6~1.EXE > nul
  2⤵
  PID:2616

C:\Windows\Debug\jaohost.exe
C:\Windows\Debug\jaohost.exe
1⤵
- Executes dropped EXE
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\jaohost.exe

Filesize
60KB

MD5
73732ce9372ed7064475162f735a2eef

SHA1
795af950612c7576b36a2e9dc10dad006dae04bc

SHA256
7bf2de56b34d25b899a399326f857798f5276307e2fd04aafa5b08c7c0149c49

SHA512
4fb5e63c465744d3e5f8fcfca91c569b30ea8259b967fe6a8a70763b48bd79efcce51965eec8022462a73a67548a2b25ca95c36fd40272292d0408c06a6fa387

Download Submit
C:\Windows\debug\jaohost.exe

Filesize
60KB

MD5
73732ce9372ed7064475162f735a2eef

SHA1
795af950612c7576b36a2e9dc10dad006dae04bc

SHA256
7bf2de56b34d25b899a399326f857798f5276307e2fd04aafa5b08c7c0149c49

SHA512
4fb5e63c465744d3e5f8fcfca91c569b30ea8259b967fe6a8a70763b48bd79efcce51965eec8022462a73a67548a2b25ca95c36fd40272292d0408c06a6fa387

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads