Analysis
-
max time kernel
170s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1faf894f070ac48d038b27ed560dff00.exe
Resource
win7-20240319-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1faf894f070ac48d038b27ed560dff00.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1faf894f070ac48d038b27ed560dff00.exe
-
Size
196KB
-
MD5
1faf894f070ac48d038b27ed560dff00
-
SHA1
fca6afefade89fd28980576541b39ba3cbc356c5
-
SHA256
8a969e0d31f85063106658997a3a0bab57949277857b1b9992155b8161d5e481
-
SHA512
70436aa8c8b2271b73f97ea09cd4b013d539e7c34fa161e7132902f79c4e1f7f6680f6a048a65b21ad3de1d9c1f3cbc5392efa3818bec24dfe52e5a320c60fda
-
SSDEEP
1536:PNqk3NV5XqOaZk1GDGe0Pdb+d6DiUYot00gw3:sw5XyzDDypy6DiUru0gE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jrkov.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1faf894f070ac48d038b27ed560dff00.exe -
Executes dropped EXE 1 IoCs
pid Process 1160 jrkov.exe -
Adds Run key to start application 2 TTPs 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /K" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /x" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /L" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /g" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /e" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /N" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /E" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /Z" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /t" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /i" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /r" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /D" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /F" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /O" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /s" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /l" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /a" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /P" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /w" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /C" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /h" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /m" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /M" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /n" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /U" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /u" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /j" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /Y" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /J" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /W" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /c" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /o" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /Q" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /q" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /S" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /v" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /f" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /I" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /X" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /p" jrkov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrkov = "C:\\Users\\Admin\\jrkov.exe /T" jrkov.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe 1160 jrkov.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3484 1faf894f070ac48d038b27ed560dff00.exe 1160 jrkov.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 1160 3484 1faf894f070ac48d038b27ed560dff00.exe 105 PID 3484 wrote to memory of 1160 3484 1faf894f070ac48d038b27ed560dff00.exe 105 PID 3484 wrote to memory of 1160 3484 1faf894f070ac48d038b27ed560dff00.exe 105 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91 PID 1160 wrote to memory of 3484 1160 jrkov.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1faf894f070ac48d038b27ed560dff00.exe"C:\Users\Admin\AppData\Local\Temp\1faf894f070ac48d038b27ed560dff00.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\jrkov.exe"C:\Users\Admin\jrkov.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:4184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5cc563686ce9a7766a5c1334c097ca05e
SHA18c587d90cbd6b092292fcbbdf8046a618c1d2b89
SHA256119487430dbc213de34d25b27a51ee94c2df466f6eb6d4b0956799c3061808ba
SHA512baa309e57dc14a2cce777e41948173f36f13a40027e4fc89f88df8e6f83bcdca72a876b60c85476800963f77e422cd5da59f86c9b92e3e16cbab9e0cb00d76d6