Analysis
-
max time kernel
169s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 13:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3887364d4e93ac0211c2644e8d93331e.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3887364d4e93ac0211c2644e8d93331e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3887364d4e93ac0211c2644e8d93331e.exe
-
Size
256KB
-
MD5
3887364d4e93ac0211c2644e8d93331e
-
SHA1
2c3b1f90fc1473bf6c01badc4a6c77c0c41f9340
-
SHA256
c87f0fa6393d2784e27f8154ccb984a9642f38bd0d071900549c973dcd1b203f
-
SHA512
30405fe94a1e67a18ccda6c3800c84e678514e2d2b8d639dd1fe053242d9cb3a5f7a72451862143eb93b7cfd7fb6d20a1723afe677e144236c36f965ce05b118
-
SSDEEP
3072:E3ZVoeDPlp/nskpCUv5T79fzCC/M7BFsqMabeYiUDoZGi33ygoo:Sf7PlptNvl9fm0UBFsqMabeYiUDogAFJ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3887364d4e93ac0211c2644e8d93331e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jiceb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 3887364d4e93ac0211c2644e8d93331e.exe -
Executes dropped EXE 1 IoCs
pid Process 2096 jiceb.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /P" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /V" 3887364d4e93ac0211c2644e8d93331e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /F" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /f" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /a" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /Y" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /q" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /x" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /r" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /T" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /v" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /H" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /W" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /B" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /c" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /m" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /Z" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /N" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /u" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /M" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /w" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /e" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /O" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /U" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /A" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /V" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /J" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /g" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /h" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /D" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /z" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /L" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /j" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /X" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /C" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /s" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /K" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /Q" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /I" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /k" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /S" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /b" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /n" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /l" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /d" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /o" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /G" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /t" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /y" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /R" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /i" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /E" jiceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiceb = "C:\\Users\\Admin\\jiceb.exe /p" jiceb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 3887364d4e93ac0211c2644e8d93331e.exe 1948 3887364d4e93ac0211c2644e8d93331e.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe 2096 jiceb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1948 3887364d4e93ac0211c2644e8d93331e.exe 2096 jiceb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2096 1948 3887364d4e93ac0211c2644e8d93331e.exe 95 PID 1948 wrote to memory of 2096 1948 3887364d4e93ac0211c2644e8d93331e.exe 95 PID 1948 wrote to memory of 2096 1948 3887364d4e93ac0211c2644e8d93331e.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3887364d4e93ac0211c2644e8d93331e.exe"C:\Users\Admin\AppData\Local\Temp\3887364d4e93ac0211c2644e8d93331e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\jiceb.exe"C:\Users\Admin\jiceb.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD57db108d68e31be5d40db235ea0b308b5
SHA1167c06394b95c1b802fea186043d2fadc18b8ba9
SHA256b22ef2dbe7c5ce1919f95bdc3e8be196378a1d3eb5d51b9fd5247b1440eedb6f
SHA5122922129fa2059623a55c61609455c5e2b25d4b815dedb75995eeb50db2cb967223c51f2807757e0f249578d4472c214474bf52e2490f7a95d43f6cccc863c6e3