35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31

Analysis

max time kernel
150s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe
Size

53KB
MD5

bec880391cdc3cd24a8114303d90227a
SHA1

190dee6e3fa40d0caf193f15a4764454700af98e
SHA256

35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31
SHA512

5dbae3d2f2575d1f3d9443a13c9ab79069f1242ba2284d2ab0bbdc2dc5570313bc05dfb68e6b741e7f040043996654ba486442895894f76e1f9e37342d4cb9c0
SSDEEP

1536:vNeg8r8QZF+h/7Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:UF+h/JJjmLM3zRJWZsXy4J9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiuopu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe

Executes dropped EXE 1 IoCs

pid	Process
3912	jiuopu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuopu = "C:\\Users\\Admin\\jiuopu.exe"	jiuopu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe
3912	jiuopu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe
3912	jiuopu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3912	5012	35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe	87
PID 5012 wrote to memory of 3912	5012	35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe	87
PID 5012 wrote to memory of 3912	5012	35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe	87
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82
PID 3912 wrote to memory of 5012	3912	jiuopu.exe	82

C:\Users\Admin\AppData\Local\Temp\35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe
"C:\Users\Admin\AppData\Local\Temp\35d40cd5729bb99358a92c6d3f3c11c99b652b9320e674766db282eac9fd2e31.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\jiuopu.exe
  "C:\Users\Admin\jiuopu.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jiuopu.exe

Filesize
53KB

MD5
f38d5a5562d56695e50c30bf71901fef

SHA1
de1fe13afe5fc0d78c9b727c3aebacd8b61111ae

SHA256
4a2383a05a419c91699a86eece1c9905ccc5d486f9ac7690f2be881afe841070

SHA512
e7077e68f8cc136313467ab1a30e67743ef3498293fa6d51822bbf84d4bc53b8fdac26803f24e9e9814f78d097e250dedbefb7e84758ce91cd549f68b08d3893

Download Submit
memory/3912-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5012-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download