3e2be012d4f0773737b38d41ee02e623d5f2b0d892ce62ce3c9b944f2e834b99

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

789fe969a81eab7f7c7a606683174f2a.exe
Size

200KB
MD5

789fe969a81eab7f7c7a606683174f2a
SHA1

9e95a38546a76c57ebd005b8d4fdc9916c2f85e0
SHA256

3e2be012d4f0773737b38d41ee02e623d5f2b0d892ce62ce3c9b944f2e834b99
SHA512

04939a899f2b77249321d8a0289fa3f8298434985afe6c73f4f11853bf5b6eda50db0a67c2aebe903084863926f4f651a8f80cc1959e6cff9f0b2ed092b6039c
SSDEEP

3072:3UAVVfI0tQ9nLHbB9WHCS0AgTlhsp3mWRMQ:hA4QxL7B9WHK9Jhsp3v/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	789fe969a81eab7f7c7a606683174f2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jauox.exe

Executes dropped EXE 1 IoCs

pid	Process
2000	jauox.exe

Loads dropped DLL 2 IoCs

pid	Process
1732	789fe969a81eab7f7c7a606683174f2a.exe
1732	789fe969a81eab7f7c7a606683174f2a.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /e"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /p"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /t"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /s"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /m"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /u"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /w"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /b"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /a"	789fe969a81eab7f7c7a606683174f2a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /l"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /o"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /i"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /v"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /r"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /q"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /c"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /k"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /d"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /n"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /z"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /x"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /h"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /j"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /a"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /g"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /y"	jauox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\jauox = "C:\\Users\\Admin\\jauox.exe /f"	jauox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	789fe969a81eab7f7c7a606683174f2a.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe
2000	jauox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	789fe969a81eab7f7c7a606683174f2a.exe
2000	jauox.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2000	1732	789fe969a81eab7f7c7a606683174f2a.exe	28
PID 1732 wrote to memory of 2000	1732	789fe969a81eab7f7c7a606683174f2a.exe	28
PID 1732 wrote to memory of 2000	1732	789fe969a81eab7f7c7a606683174f2a.exe	28
PID 1732 wrote to memory of 2000	1732	789fe969a81eab7f7c7a606683174f2a.exe	28

C:\Users\Admin\AppData\Local\Temp\789fe969a81eab7f7c7a606683174f2a.exe
"C:\Users\Admin\AppData\Local\Temp\789fe969a81eab7f7c7a606683174f2a.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\jauox.exe
  "C:\Users\Admin\jauox.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jauox.exe

Filesize
200KB

MD5
fc9aaf3f29a0e5a3c07d4bc0b629c7f8

SHA1
a8fa765653f689f3aed2213d0c3374f9585f8093

SHA256
d8166b0a02bea4c2934ad037ae7e6449791b9dfe99e3866ef504cbe366ac4ae9

SHA512
cdeba399193c9aae9c6b41087fbad50146233acd327c170ee6adf3ad14faa72568fb1e60e53b1d94e552eadad20d0dbe58a181f2342732013d3a582afb813fdb

Download Submit