Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09c8b2d0af0dabe9e25703386182d451.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
09c8b2d0af0dabe9e25703386182d451.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
09c8b2d0af0dabe9e25703386182d451.exe
-
Size
156KB
-
MD5
09c8b2d0af0dabe9e25703386182d451
-
SHA1
49591f4ff0db806ff704549e933a1f599b8c6ebb
-
SHA256
dd9e6b5905acbfc44e035857c94d2261238621c3ee9932454b9d2efe49bee112
-
SHA512
6d5d48af24cf8e5a1fa7023d5afcbf75a5d853bef009fb54b9139c405979604ac9e676c70bacd734b82a2a823542c9f0e316a2781ff59fd8e29b3cc3c97294ec
-
SSDEEP
1536:83kumQuYxCBU8gRDGHPOGMmUbaxGAka+t/K9rCGaV9mw7Jqx8M+dzAbWQgRV7:rQuYea4UbaxqkCGaVD7JqfKAbno7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" juato.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 09c8b2d0af0dabe9e25703386182d451.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 juato.exe -
Loads dropped DLL 2 IoCs
pid Process 2212 09c8b2d0af0dabe9e25703386182d451.exe 2212 09c8b2d0af0dabe9e25703386182d451.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /J" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /B" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /l" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /o" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /V" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /E" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /A" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /T" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /s" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /t" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /j" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /I" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /H" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /n" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /C" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /i" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /z" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /d" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /K" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /b" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /x" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /R" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /W" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /D" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /G" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /L" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /v" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /g" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /p" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /q" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /U" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /r" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /a" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /X" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /S" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /h" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /y" 09c8b2d0af0dabe9e25703386182d451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /P" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /c" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /Y" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /m" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /f" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /y" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /u" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /w" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /F" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /M" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /O" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /k" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /Z" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /N" juato.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\juato = "C:\\Users\\Admin\\juato.exe /e" juato.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 09c8b2d0af0dabe9e25703386182d451.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe 2680 juato.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2212 09c8b2d0af0dabe9e25703386182d451.exe 2680 juato.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2680 2212 09c8b2d0af0dabe9e25703386182d451.exe 28 PID 2212 wrote to memory of 2680 2212 09c8b2d0af0dabe9e25703386182d451.exe 28 PID 2212 wrote to memory of 2680 2212 09c8b2d0af0dabe9e25703386182d451.exe 28 PID 2212 wrote to memory of 2680 2212 09c8b2d0af0dabe9e25703386182d451.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\09c8b2d0af0dabe9e25703386182d451.exe"C:\Users\Admin\AppData\Local\Temp\09c8b2d0af0dabe9e25703386182d451.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\juato.exe"C:\Users\Admin\juato.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5dbd34d66532c3ff8ab824a5d9e5d7e5d
SHA188078aa8ea3b1632ddb12c5c65a7b243b06d3e00
SHA25664bd15e30faefd7b424e76327e31574cda039313cb19c77fa565a8e07204b7f6
SHA512221ee42455a36ec21d4be8705e156ed391a816be6b94274127e55763c93972cc54607a9c0750b42a9317412daa335fdf221d11ea56104786d907501a7910507b
-
Filesize
72KB
MD50b6eff14cad662ff2983727a7208e991
SHA1b9aaa5423cfab44af09ea23f354472bd00006e59
SHA25679132a2b9a01e2fae91ccd709f55977389d5a9d5b8c4caed0235628680dc1f25
SHA512d23db169c0c66c62857b11b23a6522a508230491611aa40e39123af6c6e8c35fdf36ba9f7a47b5b7e2e4e20ef284c994268d1089520e10939870db9f3a9d820e