Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 05:50
Static task
static1
Behavioral task
behavioral1
Sample
dd6320b125131dabd2a8215d5dae2fa4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd6320b125131dabd2a8215d5dae2fa4.exe
Resource
win10v2004-20240226-en
General
-
Target
dd6320b125131dabd2a8215d5dae2fa4.exe
-
Size
361KB
-
MD5
dd6320b125131dabd2a8215d5dae2fa4
-
SHA1
8ad8efc9d656d4525b9d00743774fbbed79bacda
-
SHA256
c24c7641930fef4c547f3fe70a8a9adf1eb5318876f1dece044f640377b5c01a
-
SHA512
abeb8162720d6f9d4fd112146a9b5b5f76463258740daedfa6e2b1d22d89cae5abe5e1a8f3931b6979a4714250883b3cac862ae33dd430cebd24538a888af1a7
-
SSDEEP
6144:UFBBSls5rfh8Y9lt7Xon2u6hcjTSShc8KDdI1NXxNdWHJRbKnajjETh2gPoL:cBBSl+rfh8sLq2udjtnKu1HOJROajjEd
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
jmu.exepid process 2644 jmu.exe -
Executes dropped EXE 1 IoCs
Processes:
jmu.exepid process 2644 jmu.exe -
Loads dropped DLL 2 IoCs
Processes:
dd6320b125131dabd2a8215d5dae2fa4.exepid process 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
Processes:
jmu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\ = "Application" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\Content Type = "application/x-msdownload" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\DefaultIcon jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\DefaultIcon\ = "%1" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\jmu.exe\" -a \"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" jmu.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/300-109-0x0000000000510000-0x0000000000526000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dd6320b125131dabd2a8215d5dae2fa4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" dd6320b125131dabd2a8215d5dae2fa4.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\3876399163 = "C:\\Users\\Admin\\AppData\\Local\\jmu.exe" dd6320b125131dabd2a8215d5dae2fa4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies registry class 41 IoCs
Processes:
jmu.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\DefaultIcon jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\jmu.exe\" -a \"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\DefaultIcon\ = "%1" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\Content Type = "application/x-msdownload" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\jmu.exe\" -a \"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start jmu.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\start jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\start\command jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\DefaultIcon jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\start\command jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\DefaultIcon\ = "%1" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\open\command jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\shell\runas jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\ = "Application" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\exefile\Content Type = "application/x-msdownload" jmu.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\ = "exefile" jmu.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" jmu.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
dd6320b125131dabd2a8215d5dae2fa4.exejmu.exepid process 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 300 dd6320b125131dabd2a8215d5dae2fa4.exe 2644 jmu.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe Token: SeShutdownPrivilege 524 explorer.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
explorer.exejmu.exepid process 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 2644 jmu.exe 2644 jmu.exe 2644 jmu.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
explorer.exepid process 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe 524 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
jmu.exepid process 2644 jmu.exe 2644 jmu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dd6320b125131dabd2a8215d5dae2fa4.exedescription pid process target process PID 300 wrote to memory of 2644 300 dd6320b125131dabd2a8215d5dae2fa4.exe jmu.exe PID 300 wrote to memory of 2644 300 dd6320b125131dabd2a8215d5dae2fa4.exe jmu.exe PID 300 wrote to memory of 2644 300 dd6320b125131dabd2a8215d5dae2fa4.exe jmu.exe PID 300 wrote to memory of 2644 300 dd6320b125131dabd2a8215d5dae2fa4.exe jmu.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd6320b125131dabd2a8215d5dae2fa4.exe"C:\Users\Admin\AppData\Local\Temp\dd6320b125131dabd2a8215d5dae2fa4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jmu.exe"C:\Users\Admin\AppData\Local\jmu.exe" -gav C:\Users\Admin\AppData\Local\Temp\dd6320b125131dabd2a8215d5dae2fa4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pki6589.tmpFilesize
255B
MD5851036f09f7c92f0504dbe76d4811257
SHA1bc474cd19121b61daf8f832414dcf1aaf166122d
SHA25601c50a506269ee8dd40b2b6461671267afec440f0d2f8133f4a444869141ed4f
SHA512ec4e9a45a2bbe9950d336b498d0dbd7a59015bd04ab46b0d91914b7007dfc56f44e93dcd2749c9e2b921618d6c4e683955f69fcc0384d49fdb9e965e5378b8ce
-
\Users\Admin\AppData\Local\jmu.exeFilesize
361KB
MD5dd6320b125131dabd2a8215d5dae2fa4
SHA18ad8efc9d656d4525b9d00743774fbbed79bacda
SHA256c24c7641930fef4c547f3fe70a8a9adf1eb5318876f1dece044f640377b5c01a
SHA512abeb8162720d6f9d4fd112146a9b5b5f76463258740daedfa6e2b1d22d89cae5abe5e1a8f3931b6979a4714250883b3cac862ae33dd430cebd24538a888af1a7
-
memory/300-54-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/300-55-0x00000000028E0000-0x0000000002A61000-memory.dmpFilesize
1.5MB
-
memory/300-56-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB
-
memory/300-109-0x0000000000510000-0x0000000000526000-memory.dmpFilesize
88KB
-
memory/300-153-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB
-
memory/524-159-0x00000000040D0000-0x00000000040D1000-memory.dmpFilesize
4KB
-
memory/524-154-0x00000000040D0000-0x00000000040D1000-memory.dmpFilesize
4KB
-
memory/524-173-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/2644-152-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB
-
memory/2644-158-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB
-
memory/2644-157-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB
-
memory/2644-156-0x0000000000400000-0x00000000004C5A00-memory.dmpFilesize
790KB