Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
7507fe5220eb790cde2d3bac05a7a866.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7507fe5220eb790cde2d3bac05a7a866.exe
Resource
win10v2004-20231215-en
General
-
Target
7507fe5220eb790cde2d3bac05a7a866.exe
-
Size
180KB
-
MD5
7507fe5220eb790cde2d3bac05a7a866
-
SHA1
938013c1286921e5bc62df878c459f1d23ccef3d
-
SHA256
b348f53510d3561dff1105806dd185646d2c92f714e5bbe82b3ac270b199a10c
-
SHA512
f71c7f5edfb9605a046da2951da5a6d9f5f6503ffc86f192e3a4818a8a1f36ea117a23a8a88f68637cb812aa24569c9602e85e9ec4180e7b3670c67e125cdb8e
-
SSDEEP
1536:e/TX5TfjxKcbNMreYNFRxxGLvTLpKNDf880IpWur+uRPFYSUxBphF+wXP:6pTjKRabfgNkSrJRVUHF++
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
jjfoq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jjfoq.exe -
Executes dropped EXE 1 IoCs
Processes:
jjfoq.exepid process 3032 jjfoq.exe -
Loads dropped DLL 2 IoCs
Processes:
7507fe5220eb790cde2d3bac05a7a866.exepid process 2420 7507fe5220eb790cde2d3bac05a7a866.exe 2420 7507fe5220eb790cde2d3bac05a7a866.exe -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
jjfoq.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /n" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /Z" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /L" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /X" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /g" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /l" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /w" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /N" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /t" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /A" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /B" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /O" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /H" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /K" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /M" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /I" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /R" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /y" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /s" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /o" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /W" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /h" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /q" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /a" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /D" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /m" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /d" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /i" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /c" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /e" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /r" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /U" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /C" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /u" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /G" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /v" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /Q" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /S" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /z" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /f" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /V" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /p" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /k" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /J" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /b" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /P" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /j" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /Y" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /T" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /F" jjfoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjfoq = "C:\\Users\\Admin\\jjfoq.exe /E" jjfoq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
jjfoq.exepid process 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe 3032 jjfoq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7507fe5220eb790cde2d3bac05a7a866.exejjfoq.exepid process 2420 7507fe5220eb790cde2d3bac05a7a866.exe 3032 jjfoq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7507fe5220eb790cde2d3bac05a7a866.exejjfoq.exedescription pid process target process PID 2420 wrote to memory of 3032 2420 7507fe5220eb790cde2d3bac05a7a866.exe jjfoq.exe PID 2420 wrote to memory of 3032 2420 7507fe5220eb790cde2d3bac05a7a866.exe jjfoq.exe PID 2420 wrote to memory of 3032 2420 7507fe5220eb790cde2d3bac05a7a866.exe jjfoq.exe PID 2420 wrote to memory of 3032 2420 7507fe5220eb790cde2d3bac05a7a866.exe jjfoq.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe PID 3032 wrote to memory of 2420 3032 jjfoq.exe 7507fe5220eb790cde2d3bac05a7a866.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7507fe5220eb790cde2d3bac05a7a866.exe"C:\Users\Admin\AppData\Local\Temp\7507fe5220eb790cde2d3bac05a7a866.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\jjfoq.exe"C:\Users\Admin\jjfoq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\jjfoq.exeFilesize
180KB
MD582f96d0f98f4a78487ce898707999f3f
SHA111f2d925243f0e4124873ccef3b72612167e76d1
SHA2567511af5b5059e698cfcabf25cea7c59ba7763166ac55a2dfc1576e7f377778e0
SHA512f2c86199a2a40580b04dc672401af8e01ca67cf6bcbaefb84bfc9a186722a60946ee24c7d49bcfeff3aed1f47eb12b52cc118e194956c8adebc4f0cc6cbfd0cc