df3f3b28e6f2e555439a4a186a3bdfce1b52c4304e9a13258087a9f908a83059

Analysis

max time kernel
170s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54758737edac1c3fc864c7ed097f088a_JC.exe
Size 392KB
Sample231014-ehdpwsfb7z
SHA256 df3f3b28e6f2e555439a4a186a3bdfce1b52c4304e9a13258087a9f908a83059
MD5 54758737edac1c3fc864c7ed097f088a
SHA1 38be4b3549b36f6917d8c41ce722dda34ede2dac
SHA512 ee84118d3ef3e2a4af9fff59849fa44b2c88e4566a7df4db5d06c6dde2e0f28023fb1e43485c51cf2ce315194ef8a374d64ac481f11028020660a0bdbdf8b4db
SSDEEP 6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	YJRSJ.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YJRSJ.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\TMJUH.EXE \"%1\" %*"	YJRSJ.EXE

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1196-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/files/0x000600000002308b-10.dat	upx
behavioral2/files/0x000b00000001e589-21.dat	upx
behavioral2/files/0x000b00000001e589-22.dat	upx
behavioral2/memory/1196-24-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1196-26-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-27-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-28-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-30-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-34-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-35-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-36-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-37-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-38-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-39-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-40-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-41-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-42-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-43-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-44-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2360-45-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MVQ.EXE = "C:\\odt\\MVQ.EXE"	54758737edac1c3fc864c7ed097f088a_JC.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	YJRSJ.EXE
File opened (read-only)	\??\P:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\R:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\G:	YJRSJ.EXE
File opened (read-only)	\??\V:	YJRSJ.EXE
File opened (read-only)	\??\L:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\N:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\O:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\Q:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\S:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\T:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\H:	YJRSJ.EXE
File opened (read-only)	\??\T:	YJRSJ.EXE
File opened (read-only)	\??\E:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\I:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\J:	YJRSJ.EXE
File opened (read-only)	\??\Q:	YJRSJ.EXE
File opened (read-only)	\??\K:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\I:	YJRSJ.EXE
File opened (read-only)	\??\O:	YJRSJ.EXE
File opened (read-only)	\??\H:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\J:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\K:	YJRSJ.EXE
File opened (read-only)	\??\U:	YJRSJ.EXE
File opened (read-only)	\??\G:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\M:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\S:	YJRSJ.EXE
File opened (read-only)	\??\E:	YJRSJ.EXE
File opened (read-only)	\??\L:	YJRSJ.EXE
File opened (read-only)	\??\M:	YJRSJ.EXE
File opened (read-only)	\??\N:	YJRSJ.EXE
File opened (read-only)	\??\R:	YJRSJ.EXE
File opened (read-only)	\??\U:	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened (read-only)	\??\V:	54758737edac1c3fc864c7ed097f088a_JC.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\JWWW.EXE	54758737edac1c3fc864c7ed097f088a_JC.exe
File created	C:\Program Files (x86)\TMJUH.EXE	YJRSJ.EXE
File created	C:\Program Files (x86)\YJRSJ.EXE	54758737edac1c3fc864c7ed097f088a_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\JXEPJMK.EXE	54758737edac1c3fc864c7ed097f088a_JC.exe
File opened for modification	C:\Windows\JXEPJMK.EXE	54758737edac1c3fc864c7ed097f088a_JC.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\BSPYBD.EXE \"%1\" %*"	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YJRSJ.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\JXEPJMK.EXE \"%1\""	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\PerfLogs\\UAFP.EXE \"%1\""	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Users\\UCNIMT.EXE %1"	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\JWWW.EXE %1"	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Windows\\JXEPJMK.EXE %1"	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	54758737edac1c3fc864c7ed097f088a_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	54758737edac1c3fc864c7ed097f088a_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\TMJUH.EXE \"%1\" %*"	YJRSJ.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	YJRSJ.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2360	1196	54758737edac1c3fc864c7ed097f088a_JC.exe	86
PID 1196 wrote to memory of 2360	1196	54758737edac1c3fc864c7ed097f088a_JC.exe	86
PID 1196 wrote to memory of 2360	1196	54758737edac1c3fc864c7ed097f088a_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\54758737edac1c3fc864c7ed097f088a_JC.exe
"C:\Users\Admin\AppData\Local\Temp\54758737edac1c3fc864c7ed097f088a_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\YJRSJ.EXE
  "C:\Program Files (x86)\YJRSJ.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YJRSJ.EXE

Path C:\Program Files (x86)\YJRSJ.EXE
Size 393KB
SHA256 df75fa0aaa6b60ea4d8efc319ca624af6d6db21f373b8a2eec311cc94ca59100
MD5 65e0a27ff2edaf90af5d19e4723e6af6
SHA1 431e09c1b43859306fc90eedf97d5af0816fece8
SHA512 d404d1c0b34d4651135939759915563a0c834f1e2ee12a3598656f2919453cbf05f26487a2d1b7dbfc05fc68fac9595824d43f77c0dd26be5cae6886dc97d2b8
SSDEEP 6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJRSJ.EXE

Path C:\Program Files (x86)\YJRSJ.EXE
Size 393KB
SHA256 df75fa0aaa6b60ea4d8efc319ca624af6d6db21f373b8a2eec311cc94ca59100
MD5 65e0a27ff2edaf90af5d19e4723e6af6
SHA1 431e09c1b43859306fc90eedf97d5af0816fece8
SHA512 d404d1c0b34d4651135939759915563a0c834f1e2ee12a3598656f2919453cbf05f26487a2d1b7dbfc05fc68fac9595824d43f77c0dd26be5cae6886dc97d2b8
SSDEEP 6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXEPJMK.EXE

Path C:\Windows\JXEPJMK.EXE
Size 393KB
SHA256 43fbf8a8a612f89c21b82e920241aabdee87bba076e58a9d19cda37daea96e27
MD5 66f89afd4c1cd331faa25a9a0a991c18
SHA1 ad992fbd57b377a4c53d305f2512fbc0feaa6b79
SHA512 da5615a975be6ac940e4cb9912a2d1227113ee6d485269aac31ffabdbe1fc38d397fa61ca6bfe84cde7bdb4614b92c9dc29b8e3b7564b3ad1eab9213488d74ed
SSDEEP 6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw
MD5 SHA1 SHA512 SSDEEP

Submit Download

filedebug

Path \??\c:\filedebug
Size 252B
SHA256 a0d76804eda7a05131ce3c5cc6a7a386ae0cba808f1883447de2fb51276049f5
MD5 eb3ad263abba265ddbd42b7e3d0e2927
SHA1 4d82e53ba8c12982646a6d4bbcc8625893b00a7a
SHA512 d8dd123d8daa372150eec29af397219b7731c6506f69382f55fe90ed7a41c43e9d0b767e14b103d799d9c17f0899584c86ae9ea63a62829f28bd1b92a28e548b
MD5 SHA1 SHA512

Submit Download

memory/1196-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1196-1-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/1196-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1196-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-36-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-29-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/2360-30-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-35-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-23-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/2360-37-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-28-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-39-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-40-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-41-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-42-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-43-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-44-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2360-45-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads