Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe
-
Size
104KB
-
MD5
50e9556854587d43f0a13b678d0dbdcd
-
SHA1
3094a1a21a613fcbc64cdd8d4cdf3546e7ab1a29
-
SHA256
fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59
-
SHA512
a220dcb9a4377394a5c6179411b9e941c90fa5dad53e9f9f86a4af1d7913513a25e9831bd428d11c9e7b9c778475b35ceaced21271335ad88eadbe2d2e47fa63
-
SSDEEP
1536:4iML/lgjJ8iLycDEJfNOPcDGwmgRouYmvqwMewT/0Xu+b5kroNIjnZ9d:2NiLyccm/3iu+bFCnvd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" juuze.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe -
Executes dropped EXE 1 IoCs
pid Process 1112 juuze.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /a" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /w" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /o" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /x" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /H" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /z" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /v" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /m" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /y" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /p" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /d" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /V" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /l" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /f" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /j" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /C" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /W" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /R" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /r" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /Z" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /M" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /h" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /B" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /J" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /i" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /S" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /b" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /k" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /P" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /n" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /L" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /t" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /K" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /O" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /X" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /Q" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /g" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /U" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /s" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /q" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /N" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /Y" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /D" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /c" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /F" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /e" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /C" fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /A" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /I" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /T" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /G" juuze.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuze = "C:\\Users\\Admin\\juuze.exe /u" juuze.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe 1112 juuze.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 1112 juuze.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1112 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 85 PID 4796 wrote to memory of 1112 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 85 PID 4796 wrote to memory of 1112 4796 fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe"C:\Users\Admin\AppData\Local\Temp\fdc4b429a101e32267395ee40b59896cc82a94bf195eb6eed76c4c7ce6fd1a59.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\juuze.exe"C:\Users\Admin\juuze.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD50110b46adeebf5867154edd7d72268d7
SHA19897e68b91c5c1ea97e5769da311609f81866e4f
SHA2561656a67e28da3ec3d2bd4df2bc2c6c0b598e73033bd49669c45f7a0481feb320
SHA5122387d5b63a393fe50db9d19e98b6cbbd5639a702a5ad4f9a3abe48566473316385892757d5ee41152eaeccda4cfb440274925fed97ba5b5ab5547f415b6fd97d