Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa3d6481c0f7ef20feead8b37f4ba2d2.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa3d6481c0f7ef20feead8b37f4ba2d2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
aa3d6481c0f7ef20feead8b37f4ba2d2.exe
-
Size
132KB
-
MD5
aa3d6481c0f7ef20feead8b37f4ba2d2
-
SHA1
6346ac3be5143bd9ad186cbe1c7c9f64b4ef5400
-
SHA256
6b6b86a13d904e2fb4a9bbd8fcc9a0337a9cfd7e744bb7c5d230afcab4462a4d
-
SHA512
a737a782feb745ebad0be2d5f3e90558872c281d929bf1431a4cf19b52da3003ae6f3126f2fa96bb5df40dcadbdc4d34547c745b49edab14680716e69f50bf4b
-
SSDEEP
3072:cXCbZSukOY8hrJFVNM/N/5sfqDfwqOKeR:iork6hrJ3NON/5sGbeR
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pjpod.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aa3d6481c0f7ef20feead8b37f4ba2d2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation aa3d6481c0f7ef20feead8b37f4ba2d2.exe -
Executes dropped EXE 1 IoCs
pid Process 1956 pjpod.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /G" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /O" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /v" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /e" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /c" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /w" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /u" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /m" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /n" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /F" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /R" aa3d6481c0f7ef20feead8b37f4ba2d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /q" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /y" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /k" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /C" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /t" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /X" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /s" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /x" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /r" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /Q" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /f" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /h" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /V" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /W" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /z" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /o" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /Z" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /E" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /l" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /K" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /j" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /N" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /M" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /A" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /H" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /i" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /R" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /U" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /J" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /L" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /I" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /p" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /T" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /g" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /D" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /a" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /b" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /Y" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /B" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /S" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /P" pjpod.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjpod = "C:\\Users\\Admin\\pjpod.exe /d" pjpod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe 1956 pjpod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 1956 pjpod.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2812 wrote to memory of 1956 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 93 PID 2812 wrote to memory of 1956 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 93 PID 2812 wrote to memory of 1956 2812 aa3d6481c0f7ef20feead8b37f4ba2d2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa3d6481c0f7ef20feead8b37f4ba2d2.exe"C:\Users\Admin\AppData\Local\Temp\aa3d6481c0f7ef20feead8b37f4ba2d2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\pjpod.exe"C:\Users\Admin\pjpod.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56c026ba3f784ec8c7c86daae58bbb678
SHA1e7236bdc5c9ab8b264f37b33c79332e37ba72816
SHA25621a5914973d6c045479724987d6665bb3a65863630686543a069c3fea5975b2c
SHA5124547db42d1a590ba6a96f70928ce531c2c894e025f7f94810406f6394d8fc7c68d9bf7e2cfebe86c02954d738e8f14b13114eaf8c924a04222a60f304ca443c2