Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 19:41
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_7.3.0_x86_en-US.msi
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
JJSploit_7.3.0_x86_en-US.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
JJSploit_7.3.0_x86_en-US.msi
-
Size
5.8MB
-
MD5
9c232fe2ede51929244afc5c67e53b51
-
SHA1
8e8bb0eda09d25c1f44b8abd66a7e15a414b76f5
-
SHA256
1985fdbec700334fbb2c907f37a102930744e6b3e9198c25f516eae9f6854e9b
-
SHA512
d7ba56ed15a4bb482a69543e6bfe11d0aed4bf6b6b037d51dc2d191e1eaae187d1297bbb7c847d73259c34bb9ee26f26f3689c2592b4ff92968101303be61492
-
SSDEEP
98304:57AC5TdoYMyLSRpyviWkKPm7I2lLYaQ9OoSwYQf9Ib9XuvmhueA34SHeFblFY6nm:/T+USRLWtPm/O9SwYmIb9S5K3F6Wa
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1688 msiexec.exe Token: SeIncreaseQuotaPrivilege 1688 msiexec.exe Token: SeSecurityPrivilege 2112 msiexec.exe Token: SeCreateTokenPrivilege 1688 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1688 msiexec.exe Token: SeLockMemoryPrivilege 1688 msiexec.exe Token: SeIncreaseQuotaPrivilege 1688 msiexec.exe Token: SeMachineAccountPrivilege 1688 msiexec.exe Token: SeTcbPrivilege 1688 msiexec.exe Token: SeSecurityPrivilege 1688 msiexec.exe Token: SeTakeOwnershipPrivilege 1688 msiexec.exe Token: SeLoadDriverPrivilege 1688 msiexec.exe Token: SeSystemProfilePrivilege 1688 msiexec.exe Token: SeSystemtimePrivilege 1688 msiexec.exe Token: SeProfSingleProcessPrivilege 1688 msiexec.exe Token: SeIncBasePriorityPrivilege 1688 msiexec.exe Token: SeCreatePagefilePrivilege 1688 msiexec.exe Token: SeCreatePermanentPrivilege 1688 msiexec.exe Token: SeBackupPrivilege 1688 msiexec.exe Token: SeRestorePrivilege 1688 msiexec.exe Token: SeShutdownPrivilege 1688 msiexec.exe Token: SeDebugPrivilege 1688 msiexec.exe Token: SeAuditPrivilege 1688 msiexec.exe Token: SeSystemEnvironmentPrivilege 1688 msiexec.exe Token: SeChangeNotifyPrivilege 1688 msiexec.exe Token: SeRemoteShutdownPrivilege 1688 msiexec.exe Token: SeUndockPrivilege 1688 msiexec.exe Token: SeSyncAgentPrivilege 1688 msiexec.exe Token: SeEnableDelegationPrivilege 1688 msiexec.exe Token: SeManageVolumePrivilege 1688 msiexec.exe Token: SeImpersonatePrivilege 1688 msiexec.exe Token: SeCreateGlobalPrivilege 1688 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1688 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_7.3.0_x86_en-US.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1688
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112