b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Juice-setup-win-x64-v3.0.5.exe
Size 102.2MB
Sample240511-ecm2daed35
SHA256 b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301
MD5 567e0931cee1036c7341f161fe9cf3be
SHA1 419909ca2052b6c2627934c58dc77fb418c25f69
SHA512 199ea86805fc8fabba98f379ce3476edfdd4dad00d40109c143d433433d3be886b512b24214070bf2816bed44b5331e65e894e03cc9821794e09050bfc2839b4
SSDEEP 3145728:dlox4Gg70CRuBnUovMh6ho4EBdSKFKmZKh4WCjZpV:7u4oAOvvMhyfodSKF5ZY4WClpV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Juice Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Juice Client.exe

Executes dropped EXE 6 IoCs

pid	Process
4712	Juice Client.exe
1984	Juice Client.exe
2616	Juice Client.exe
4636	Juice Client.exe
3412	Juice Client.exe
3304	Juice Client.exe

Loads dropped DLL 16 IoCs

pid	Process
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
4712	Juice Client.exe
1984	Juice Client.exe
1984	Juice Client.exe
1984	Juice Client.exe
1984	Juice Client.exe
4636	Juice Client.exe
2616	Juice Client.exe
3412	Juice Client.exe
3304	Juice Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2976	tasklist.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Juice Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Juice Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Juice Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Juice Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Juice Client.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1092	Juice-setup-win-x64-v3.0.5.exe
1092	Juice-setup-win-x64-v3.0.5.exe
2976	tasklist.exe
2976	tasklist.exe
2616	Juice Client.exe
2616	Juice Client.exe
4636	Juice Client.exe
4636	Juice Client.exe
3412	Juice Client.exe
3412	Juice Client.exe
3304	Juice Client.exe
3304	Juice Client.exe
3304	Juice Client.exe
3304	Juice Client.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	tasklist.exe
Token: SeSecurityPrivilege	1092	Juice-setup-win-x64-v3.0.5.exe
Token: 33	3612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3612	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4712	Juice Client.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1752	1092	Juice-setup-win-x64-v3.0.5.exe	85
PID 1092 wrote to memory of 1752	1092	Juice-setup-win-x64-v3.0.5.exe	85
PID 1092 wrote to memory of 1752	1092	Juice-setup-win-x64-v3.0.5.exe	85
PID 1752 wrote to memory of 2976	1752	cmd.exe	87
PID 1752 wrote to memory of 2976	1752	cmd.exe	87
PID 1752 wrote to memory of 2976	1752	cmd.exe	87
PID 1752 wrote to memory of 2156	1752	cmd.exe	88
PID 1752 wrote to memory of 2156	1752	cmd.exe	88
PID 1752 wrote to memory of 2156	1752	cmd.exe	88
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 1984	4712	Juice Client.exe	97
PID 4712 wrote to memory of 2616	4712	Juice Client.exe	98
PID 4712 wrote to memory of 2616	4712	Juice Client.exe	98
PID 4712 wrote to memory of 4636	4712	Juice Client.exe	99
PID 4712 wrote to memory of 4636	4712	Juice Client.exe	99
PID 4712 wrote to memory of 3412	4712	Juice Client.exe	112
PID 4712 wrote to memory of 3412	4712	Juice Client.exe	112
PID 4712 wrote to memory of 3304	4712	Juice Client.exe	118
PID 4712 wrote to memory of 3304	4712	Juice Client.exe	118

C:\Users\Admin\AppData\Local\Temp\Juice-setup-win-x64-v3.0.5.exe
"C:\Users\Admin\AppData\Local\Temp\Juice-setup-win-x64-v3.0.5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Juice Client.exe" | find "Juice Client.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Juice Client.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\SysWOW64\find.exe
    find "Juice Client.exe"
    3⤵
    PID:2156

C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
"C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
  "C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe" --type=gpu-process --field-trial-handle=1472,1197028826626488640,5231468270762675904,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1984
- C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
  "C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,1197028826626488640,5231468270762675904,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes --secure-schemes=juiceclient --bypasscsp-schemes --cors-schemes=juiceclient --fetch-schemes --service-worker-schemes --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
  "C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe" --type=renderer --field-trial-handle=1472,1197028826626488640,5231468270762675904,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --standard-schemes --secure-schemes=juiceclient --bypasscsp-schemes --cors-schemes=juiceclient --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\juice-client\resources\app.asar" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Programs\juice-client\resources\app.asar\src\preload.js" --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
  "C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1472,1197028826626488640,5231468270762675904,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --standard-schemes --secure-schemes=juiceclient --bypasscsp-schemes --cors-schemes=juiceclient --fetch-schemes --service-worker-schemes --mojo-platform-channel-handle=652 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe
  "C:\Users\Admin\AppData\Local\Programs\juice-client\Juice Client.exe" --type=gpu-process --field-trial-handle=1472,1197028826626488640,5231468270762675904,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAABwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1084 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534 0x530
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\juice-client\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\juice-client\chrome_100_percent.pak
Size 176KB
SHA256 7cb9d93a16e5621ab765e3f3b459f4698ae496035e283f2c0c390b188a487741
MD5 d5719b1f791ac999c3cfda2e4405bdce
SHA1 c5d94054bcb271dee08714c313476abd67be28ca
SHA512 ce75bde78ddf6bc394662c5d0ce107ba375b13bf75a31ba1888dffa74900fa86babd65ce222c38db73a11c8d54b3c6f6046b8f71ce80281eec884fd7f0cd1583
SSDEEP 3072:IDKzwVbpDhO54UCZIQ2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJMgfI:IDKzwVXOHCZ3x5c1YC7x10fSucY7OP2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\juice-client\chrome_200_percent.pak
Size 313KB
SHA256 070a6cb68318a032ec17cd7b07f8af8bd6983f16997f50a231d232396a2f570f
MD5 0649df49260e18326c9a54545131aaec
SHA1 76de40e3b828cb42cb8b9beb31808ea2145eda56
SHA512 c196726564ea218c1e58121f43ab6f138a676a47cd53ad9099daec4cc3a491cf7f9127c56f31f8ec460080ba5f2f56eb2f6c7d37e286e05c4dbd9592552185d4
SSDEEP 6144:0rDQYak+9bMOHCZLz73QYV85u/oFYvwoytKi6obByPGlPFYKyo+:0YfzEg5u/oFFpxLlFYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\juice-client\ffmpeg.dll
Size 2.7MB
SHA256 6120f574e90b83a96702cfc93e8316fad4ea22669cca19e2e49b0db8b5f7e4b1
MD5 a099daa409ef4bc7267e4fb12c719c24
SHA1 04333da763bf2bffea22ed2d9822a97bbbedc942
SHA512 6d852dd8dbdfd8f0bbf29bf854d1f528ef30ffbaf8da548127d9a186bdee138a831787e6a3ea1204cd3f16c860d077d912dce65aaeda87bc6a26e6cd6b518c14
SSDEEP 49152:uVtTXiHnB+JD20P2jtEkt1HTSPSbVfhOfs9XOee7dhljxwELGpCWCcnYhpZ6ozH2:uHiUJRu1ELYnYaaXkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\juice-client\icudtl.dat
Size 10.0MB
SHA256 933a56d356e5dd6b5b9fa5181d657dc0c4d4ff62ffd3547290a6cf6bbb13245e
MD5 af6617ee653132e5b8a6b4c120e5e7a0
SHA1 64ddfae85aa50b0cedb280de51bfd7405a40f112
SHA512 34bf6fdc5e91187bba148505d22f32c13cc6cc038a2fac069381d6345cf22bf398b1a6ca2929b0d00734c41f579fde271363b2b0dd87e2e8dfc73afa2880bc5b
SSDEEP 196608:yb+wSv9AAQbNjliXUxR0rHf93WhlA6tQYF:y5KlQbBliXUxR0rHf93WhlA6tQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\juice-client\libEGL.dll
Size 428KB
SHA256 2907d96beb8ba1f7c705b654fec66cfacfe7cf3912d043aad5a8ffac91e45456
MD5 6d9f867d6b030b7c01827065d89561c6
SHA1 faa2336c79eef66bfec8783baea1360f00051a12
SHA512 7af837028446806553c9336aff67b9776786ddc891cca8dbd698eb2e72cba09bfe823d6a7cc6cd2e1d7734f5eb4ddf6b0e30558d816ab19cd7d57ca627d1aa28
SSDEEP 6144:SY9Lb+XOh+hzKL+ptr9kDMp6pd4JOXOiV:SILb+XOhGKLq4d4JOX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\juice-client\libglesv2.dll
Size 9.2MB
SHA256 bff3726dace1f22da9e1333384b08c968d9c139f93f3c8ff221067017bd6fb92
MD5 36771a90b15187dfbc5625da2881e23f
SHA1 83dc85833cb840c743c08abc7d41190c0b0813f3
SHA512 de946a1cb2c8a64252afc342b20ae4e26fa83b7be05f155563e480518fa96fe362cc7106f07d3020f558268f71627b3fb29a49377a581ce69d35d8d827421a27
SSDEEP 49152:GCjn7nH142/x/Hr6H4YMvy27+gjk7ia34y4UWseQ0sJ4/Giscx7GLgtPcoKi+tnm:V5Ra4YMOMKTd2V2rL6bJdPwjJWV8Zr
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\juice-client\locales\en-US.pak
Size 80KB
SHA256 fdeb2723f423dfe7ee4c19cc052398cbe796bfce7d432d0abe4ea40e6c6e3dab
MD5 69d7c5168de6b4311a36c39ca7ca60f0
SHA1 40ff72437b51677065d68a6486e3b03e0a27102d
SHA512 4e1fd01bd7d5f65f8aa2f0b2f4845106df916a53dd4898d0cec7fc538c2908d22f4ffd3dacf023c7854f4854534468a9bc93763be21075661501c6ceca2ca0e7
SSDEEP 1536:j77hrnf6E0fIEprADDNQ2trhCh5wBxgrSONJedMZrIzUhxaNfDggl+CZfZMwv:3FrfGIEprAHHBxgNlx0ggl+CUwv
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\juice-client\resources.pak
Size 4.1MB
SHA256 2fe8dd43b377a908df6454ec3005b3e25409a82bfb45c35ba871f05cc578c21e
MD5 977bdf44c3bd2fa5ece6f23915a7acc6
SHA1 df371edc31eb80fe0899447deac2921f519c8cc5
SHA512 d437bcc48bec3ad66a5cd0e6d6c3948276b897f6eca034b3c221ea1dc00fe7b27425d1491a1634b6ac843fc1f12aecd20bf2a7da5fe8023aac824adc0f791639
SSDEEP 98304:CjMjydYMcjtzkYbxRXl1hxUApYrjgGMLdZJFyRh5OH2H17:CuaYMmtYYb7DhZgYdvFH2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\juice-client\resources\app.asar
Size 4.2MB
SHA256 81117eef5649ce3dabc5a444d311f709ae1e9eb050146239ec74098854e5696c
MD5 0d68353ec3cf9d373ba396579c507121
SHA1 71eec72d3f597804d6ea26ee380382d0fb3edd91
SHA512 ee001b50107e75fe36e7c7923e088a3689a39bcf26b7a4cdf100a265ffd016fb9e715f44a3c69ded7c573ad7ab861295b323dfcd4261c93f680c08defb044031
SSDEEP 49152:IXy+C+Xv84v8mbavMOT12l4hg1BdfaGfT2S5X5kS2l20FhAgsJsZJsWJWdLjJGoG:IXy+C+XvrvJhl4hWa22ii
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\juice-client\v8_context_snapshot.bin
Size 167KB
SHA256 81086f6011d727fc9d7f2d0c44d65aeb5c0a56102b2b60dcab43867b1d4d5202
MD5 52072b5cef2f16f0d35f3d80e356c785
SHA1 94edd04e1e2e0937b4a7ef42b66ad730c08218f5
SHA512 ed3d4e22a2c9160f5c0a53304fd03adca709eb7ea02302b8d0f47439a8a5db5823f6bb11500b8ffb22c34c58c0e4e10436811bd9af03ba6b5d425e6aabd47968
SSDEEP 3072:FtIunvJiVG/QpTH1H3kDL/jlzET5jqBz2ekWbNgxnX9fvODj+LyBPsxt/I:FbnvMVG/QpTHJkzEdfg4Nfv2ExlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3FD9.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

57ec289e-3c9c-4c1a-8946-8b77957ecdf9.tmp

Path C:\Users\Admin\AppData\Roaming\juice-client\57ec289e-3c9c-4c1a-8946-8b77957ecdf9.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\juice-client\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e8568b091bcc1d12a9139398890e2df4f6e14d67209c01f68b687c283c9b2a4d
MD5 e11e3ff027388e4508d8b08234c0363a
SHA1 10a278c1748917848f4dfbd8100e105fc7e1ba22
SHA512 550175a0769a74f627cf963dab2b0fe2916437b8b381c45968300d369da253e3eaeb866711ef6c4f8d9b62d16ac679ed697b12327dc6e40a9d4a5d1aa34a031d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\juice-client\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4de0e5678db6aaa9cf7ab26278d42237ab3ef4eaf68122133ca4d901d502a27e
MD5 750d26948a7a388ef820612730f6fd49
SHA1 86ecd5f9def24888f158d0ed70b82b39f7e96575
SHA512 1f0795be569d2098dae3963ff1272df3a5a9739ff3e15c62ecfe8735d14d6b3f2265768e2b494b9b3df6fe8a892afdcad585671a033686891207f4b53dfe2799
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\juice-client\Network Persistent State
Size 633B
SHA256 514dfaef89bef3209d85e2f4682a22452705aeadcbcafcf5cea828fb1a93d1c7
MD5 c46f0b8ee20267c8ff27e280d71eedfb
SHA1 836936f384daed30d0534b88366e2f67e37299b1
SHA512 ed000c34e67200f18fcbdde28cfbb213decfc881ea8a18f8bc15ec2ff950a0adb608d9dc905a7db4adabe4f1a8d772205502b924aaed07e222b9af73f99ea20d
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe58724d.TMP

Path C:\Users\Admin\AppData\Roaming\juice-client\Network Persistent State~RFe58724d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\juice-client\config.json
Size 600B
SHA256 ca76443d95aabb3f78c3a2aaf0f0bd08694144c5b26eb69b50c9795cb5d17413
MD5 cc95ecadf9404599b2e17896ecb7c4db
SHA1 fda89fe6df7e95fd7f3d9b849e64ba9241302261
SHA512 18be946c85780d6218e970441b4d068b6f0e11502254763ccadf882146a3d04ae10747c938cda7e3fbdc176b338b6d4c63a8546b36feafafaadfad28fb950ef1
MD5 SHA1 SHA512

Submit Download

en-US-9-0.bdic

Path C:\Users\Admin\AppData\Roaming\juice-client\en-US-9-0.bdic
Size 441KB
SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
MD5 a78ad14e77147e7de3647e61964c0335
SHA1 cecc3dd41f4cea0192b24300c71e1911bd4fce45
SHA512 dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101
SSDEEP 12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1984-211-0x00007FFF2B660000-0x00007FFF2B661000-memory.dmp

Download

memory/1984-319-0x0000015EC5620000-0x0000015EC56CD000-memory.dmp

Download