Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/05/2024, 21:34
Behavioral task
behavioral1
Sample
CL.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
General
- Target CL.exe
- Size 31KB
- Sample240521-1e17nsbb89
- SHA256 02879d94414bb75a4167bea440b3e538e13ddcb325a66d88404629afc83395dd
- MD5 d7e87763288419fb13d503ebb46bfbf2
- SHA1 54b7f3497b1ac1767fbe9f830e9feba03482518b
- SHA512 6ccf406712260b1508347df04fc4e002f7572b04a974b203f0522132fa0051b1dc4e12710dba711cd54c3ee1e5bfa6b8f007ad214038c187c0eb924080fe7132
- SSDEEP 768:+dQZlGFnf6zxV+Ny/kfxfbvCYoQmIDUu0ti0zGj:1Iq8bnoQVkej
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4772 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation CL.exe - Executes dropped EXE 1 IoCs
pid Process 1620 jawa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe 2060 CL.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2060 CL.exe Token: SeDebugPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe Token: 33 1620 jawa.exe Token: SeIncBasePriorityPrivilege 1620 jawa.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1620 2060 CL.exe 91 PID 2060 wrote to memory of 1620 2060 CL.exe 91 PID 2060 wrote to memory of 1620 2060 CL.exe 91 PID 1620 wrote to memory of 4772 1620 jawa.exe 94 PID 1620 wrote to memory of 4772 1620 jawa.exe 94 PID 1620 wrote to memory of 4772 1620 jawa.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\CL.exe"C:\Users\Admin\AppData\Local\Temp\CL.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Roaming\jawa.exe"C:\Users\Admin\AppData\Roaming\jawa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\jawa.exe" "jawa.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\jawa.exe
- Size 31KB
- SHA256 02879d94414bb75a4167bea440b3e538e13ddcb325a66d88404629afc83395dd
- MD5 d7e87763288419fb13d503ebb46bfbf2
- SHA1 54b7f3497b1ac1767fbe9f830e9feba03482518b
- SHA512 6ccf406712260b1508347df04fc4e002f7572b04a974b203f0522132fa0051b1dc4e12710dba711cd54c3ee1e5bfa6b8f007ad214038c187c0eb924080fe7132
- SSDEEP 768:+dQZlGFnf6zxV+Ny/kfxfbvCYoQmIDUu0ti0zGj:1Iq8bnoQVkej
- MD5 SHA1 SHA512 SSDEEP