Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 05:43
Static task
static1
Behavioral task
behavioral1
Sample
ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe
Resource
win10v2004-20240508-en
General
-
Target
ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe
-
Size
312KB
-
MD5
0ee9b41689676c79004980e3245cc5b8
-
SHA1
5731264114d4d589b7d927ac7fc0a75d7e7789fd
-
SHA256
ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472
-
SHA512
3265389ff1cc228ab0d819d526617dc29629ab388a645b406ccfea8c9fe567cd873012d4605cbc49c439d2f176f56866c649838049b23dd5460e297b03b487ea
-
SSDEEP
6144:HIbc0f7XP+g3AGJpWVzuQGRHeEgRK/fObT/bGiJKv6R7MkZ4lUr8W9HuOGKhvsM6:ow27/XvLWpuQUeEgRK/fObT/bGiJlMks
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cjyeuy.exe -
Executes dropped EXE 1 IoCs
pid Process 1596 cjyeuy.exe -
Loads dropped DLL 2 IoCs
pid Process 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /p" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /L" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /g" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /c" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /s" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /a" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /N" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /n" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /l" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /U" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /k" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /Q" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /G" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /f" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /P" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /O" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /F" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /S" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /E" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /J" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /d" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /t" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /d" ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /K" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /r" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /T" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /z" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /Y" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /C" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /e" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /M" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /m" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /i" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /j" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /I" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /v" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /q" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /x" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /W" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /D" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /B" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /b" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /Z" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /R" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /w" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /h" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /A" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /H" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /X" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /o" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /V" cjyeuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\cjyeuy = "C:\\Users\\Admin\\cjyeuy.exe /u" cjyeuy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe 1596 cjyeuy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 1596 cjyeuy.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1596 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 29 PID 2140 wrote to memory of 1596 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 29 PID 2140 wrote to memory of 1596 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 29 PID 2140 wrote to memory of 1596 2140 ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe"C:\Users\Admin\AppData\Local\Temp\ff85635cfd08235a16e0afa04cdaedaea88c5a815edc343c3d5299231e0e9472.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\cjyeuy.exe"C:\Users\Admin\cjyeuy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD517a00b127b604e7ad540ba81d8563c8e
SHA109bf2ec75b004f809aa6e259a44802a5e0dc7833
SHA256fbfa75516b7ff00bb4f2f310964a2a333d45d57f8f713e4cf4cf4372c7f490fe
SHA5128a0f9c72ce39d447711d8063fb2a46e908311b23c29da12ec31c62ab15ba0cae6501e1385e9e669e4bd3049997f4fe9a7ca0da7bbf6b7826c445272bc1e0220c