21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe
Size

624KB
MD5

cfd886dc465aadc24750186bbfcb194c
SHA1

d6feec3bc2277bbc914210cc65d167193c5d1648
SHA256

21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617
SHA512

922d8ea8853366ad136bf0ff3c21cbcf2fe5b94b3619685da1ce33b8e6217ad65c747e468ec0107cbe9eff4fba08722d3e5cf47540c106312ddf57111f834d68
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0zbwcSw8dxBNZlwIe6I+cEnJlY:P1/aGLDCM4D8ayGMvbwbhlwuY

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	cjsvip.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe
2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\cjsvip.exe"	cjsvip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cjsvip.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2684	2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe	30
PID 2368 wrote to memory of 2684	2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe	30
PID 2368 wrote to memory of 2684	2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe	30
PID 2368 wrote to memory of 2684	2368	21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe	30

C:\Users\Admin\AppData\Local\Temp\21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe
"C:\Users\Admin\AppData\Local\Temp\21c73ad01b26a9bbbd4d57cb698bd0fb9fe03cc72efab51d95cd72bef56c0617.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\ProgramData\cjsvip.exe
  "C:\ProgramData\cjsvip.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
624KB

MD5
129fd87247e1358370f5893341142313

SHA1
5a051ab548eb4ef041ced9dc76e0828a624e45ca

SHA256
a01f6d58d2bfd44868ed391f96b6bf529e6cc08ce32dd484033bfad4bc6c2db5

SHA512
ac04541105ec9d1312a317742332e3a4b44277fd6ff36d5f5d1b16034bc5fe744589a0b7e406e474f528f1f37d8ab978ec9f09485fc029a2b24a2dde6cb56206

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
255KB

MD5
3b199066399b355a1567696853b81067

SHA1
fc6141e5285acc40a362420ee5779b90b16aea64

SHA256
b79fa16bcf19176850f07c841a98aefb3f149bf9004dcd70f71fdc980e3fec1d

SHA512
48d87eed230ab65fdd4e00e528ca334123d1fd41a315b3428dbad35158083057bd92a091fdf77982a756851ac22fb8f18e7edcaf0e7625c938a2412ac5e24198

Download Submit
C:\ProgramData\cjsvip.exe

Filesize
369KB

MD5
d75a71a70829bf8538de07df3cf89da5

SHA1
5cc9394a564bf075491957d3725d55df19ae9659

SHA256
45b18a1bce3646318d60df4f87e9fdec3b13f5a719bfbd84a02ce63d390c61ba

SHA512
c880975e2b95b726b69024fbaa856057d228005424d7466143aff1c01f29779d5f23fb2b08498c775e8e033ba352b0ffc0a73c9e339bcb0a016a5d79789fa826

Download Submit
memory/2368-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2368-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2684-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads