Analysis

  • max time kernel
    143s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2024 21:01

General

  • Target

    jjsploit.rar

  • Size

    66.4MB

  • MD5

    49acebfd72357fea16b1b716e3e422d0

  • SHA1

    b03eabab8cdda5902357d2ca2bedb1e7dfe07c8f

  • SHA256

    6a66dbced3c4174929db5a1f877947a8e2cd53e602bdb75163f56b076c714f5c

  • SHA512

    3d5027880f808f88c00ae4c0a1f147441d17bd833dc0104f6d30317c0b98758501b3e8f4f7bd2a39aaece1142509192f3623b5533707081223aa7dd8ee8e346e

  • SSDEEP

    1572864:N2c0ujC2xsadQG2WSRSr8zpARMcH6DdqQbaxXlH+JSKR4bjZk5iZYD5:rjC2H2WSMIpLcaTa3eqby59F

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\jjsploit.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jjsploit.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jjsploit.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\jjsploit.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2664-30-0x000007FEFAE50000-0x000007FEFAE84000-memory.dmp

    Filesize

    208KB

  • memory/2664-29-0x000000013FDA0000-0x000000013FE98000-memory.dmp

    Filesize

    992KB

  • memory/2664-32-0x000007FEFAE30000-0x000007FEFAE48000-memory.dmp

    Filesize

    96KB

  • memory/2664-33-0x000007FEFAE10000-0x000007FEFAE27000-memory.dmp

    Filesize

    92KB

  • memory/2664-36-0x000007FEF79E0000-0x000007FEF79F1000-memory.dmp

    Filesize

    68KB

  • memory/2664-35-0x000007FEFADD0000-0x000007FEFADE7000-memory.dmp

    Filesize

    92KB

  • memory/2664-31-0x000007FEF5F30000-0x000007FEF61E6000-memory.dmp

    Filesize

    2.7MB

  • memory/2664-37-0x000007FEF7740000-0x000007FEF775D000-memory.dmp

    Filesize

    116KB

  • memory/2664-38-0x000007FEF7720000-0x000007FEF7731000-memory.dmp

    Filesize

    68KB

  • memory/2664-34-0x000007FEFADF0000-0x000007FEFAE01000-memory.dmp

    Filesize

    68KB

  • memory/2664-39-0x000007FEF5A00000-0x000007FEF5C0B000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-44-0x000007FEF6BC0000-0x000007FEF6BD1000-memory.dmp

    Filesize

    68KB

  • memory/2664-43-0x000007FEF7700000-0x000007FEF7718000-memory.dmp

    Filesize

    96KB

  • memory/2664-42-0x000007FEF6BE0000-0x000007FEF6C01000-memory.dmp

    Filesize

    132KB

  • memory/2664-41-0x000007FEF6C10000-0x000007FEF6C51000-memory.dmp

    Filesize

    260KB

  • memory/2664-51-0x000007FEF48B0000-0x000007FEF4917000-memory.dmp

    Filesize

    412KB

  • memory/2664-50-0x000007FEF4920000-0x000007FEF4950000-memory.dmp

    Filesize

    192KB

  • memory/2664-49-0x000007FEF6570000-0x000007FEF6588000-memory.dmp

    Filesize

    96KB

  • memory/2664-48-0x000007FEF6590000-0x000007FEF65A1000-memory.dmp

    Filesize

    68KB

  • memory/2664-47-0x000007FEF65B0000-0x000007FEF65CB000-memory.dmp

    Filesize

    108KB

  • memory/2664-46-0x000007FEF6B80000-0x000007FEF6B91000-memory.dmp

    Filesize

    68KB

  • memory/2664-45-0x000007FEF6BA0000-0x000007FEF6BB1000-memory.dmp

    Filesize

    68KB

  • memory/2664-40-0x000007FEF4950000-0x000007FEF5A00000-memory.dmp

    Filesize

    16.7MB

  • memory/2664-61-0x000007FEF1F00000-0x000007FEF1F17000-memory.dmp

    Filesize

    92KB

  • memory/2664-60-0x000007FEF46C0000-0x000007FEF46D2000-memory.dmp

    Filesize

    72KB

  • memory/2664-59-0x000007FEF46E0000-0x000007FEF46F1000-memory.dmp

    Filesize

    68KB

  • memory/2664-58-0x000007FEF4700000-0x000007FEF4723000-memory.dmp

    Filesize

    140KB

  • memory/2664-56-0x000007FEF4750000-0x000007FEF4774000-memory.dmp

    Filesize

    144KB

  • memory/2664-55-0x000007FEF4780000-0x000007FEF47A8000-memory.dmp

    Filesize

    160KB

  • memory/2664-54-0x000007FEF47B0000-0x000007FEF4807000-memory.dmp

    Filesize

    348KB

  • memory/2664-52-0x000007FEF4830000-0x000007FEF48AC000-memory.dmp

    Filesize

    496KB

  • memory/2664-57-0x000007FEF4730000-0x000007FEF4748000-memory.dmp

    Filesize

    96KB

  • memory/2664-53-0x000007FEF4810000-0x000007FEF4821000-memory.dmp

    Filesize

    68KB