Resubmissions
07-04-2024 23:06
240407-23wgrshd72 707-04-2024 22:33
240407-2gjwvage2w 707-04-2024 22:21
240407-193nzsgd62 3Analysis
-
max time kernel
5s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:06
Static task
static1
Behavioral task
behavioral1
Sample
Judosa Point.exe
Resource
win7-20240221-en
General
-
Target
Judosa Point.exe
-
Size
73.4MB
-
MD5
eb3f4d5675cb14b5319088e6f467e75a
-
SHA1
a6761e558df1db71137ac621bd305def9f77814b
-
SHA256
972c671ab90ff0f6918f9e50b5c03ba03eb137a103d58c8f9296a45198e5795f
-
SHA512
b00d4eb2e8802c20b50674d9f0d4de655fb157727f7a85b28adf77a72d9485c79ffe2358e0ff65de5ceaa38e90fed6d00a00f1f816607220b73778a1ae36504b
-
SSDEEP
1572864:PpJ39Kk9MjWKCKVM5B8ceyIS7nqYdd6hIEhSmnJZxRByuZXFqsB:Pwk9MjxCSE/vP7nMhJnzxRB5ZX5B
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
Judosa Point.exepid process 2092 Judosa Point.exe 2092 Judosa Point.exe 2092 Judosa Point.exe 2092 Judosa Point.exe 2092 Judosa Point.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Judosa Point.exetasklist.exepid process 2092 Judosa Point.exe 2456 tasklist.exe 2456 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tasklist.exeJudosa Point.exedescription pid process Token: SeDebugPrivilege 2456 tasklist.exe Token: SeSecurityPrivilege 2092 Judosa Point.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Judosa Point.execmd.exedescription pid process target process PID 2092 wrote to memory of 2760 2092 Judosa Point.exe cmd.exe PID 2092 wrote to memory of 2760 2092 Judosa Point.exe cmd.exe PID 2092 wrote to memory of 2760 2092 Judosa Point.exe cmd.exe PID 2092 wrote to memory of 2760 2092 Judosa Point.exe cmd.exe PID 2760 wrote to memory of 2456 2760 cmd.exe tasklist.exe PID 2760 wrote to memory of 2456 2760 cmd.exe tasklist.exe PID 2760 wrote to memory of 2456 2760 cmd.exe tasklist.exe PID 2760 wrote to memory of 2456 2760 cmd.exe tasklist.exe PID 2760 wrote to memory of 2552 2760 cmd.exe find.exe PID 2760 wrote to memory of 2552 2760 cmd.exe find.exe PID 2760 wrote to memory of 2552 2760 cmd.exe find.exe PID 2760 wrote to memory of 2552 2760 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Judosa Point.exe"C:\Users\Admin\AppData\Local\Temp\Judosa Point.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq 0x32.exe" | %SYSTEMROOT%\System32\find.exe "0x32.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq 0x32.exe"3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "0x32.exe"3⤵PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df