b0f3351931f07afe4e40c3d2fe72f70807eb99ff151c35bde1c4628f2d162b39

General

Target

6204288ceceda15b35daa28a01a461d0N.exe
Size

163KB
MD5

6204288ceceda15b35daa28a01a461d0
SHA1

dd91c9399ed2b1e8ef87b37f5d73f15116d6c82b
SHA256

b0f3351931f07afe4e40c3d2fe72f70807eb99ff151c35bde1c4628f2d162b39
SHA512

e34de70e8ea9cb2c2ab7b811dea697b36f9e5b309e59c1cb3404f934e9acf0d9b056f13ec79aaa885a440d3f718982c0d2d696f0cb6448d92787c29203c5fffc
SSDEEP

1536:kVdmQr3Z5IfQmv81aypP1s3yX+tlehTzy:008JOfQm01F9s3yX+fehTm

Score

8^/10

defense_evasion discovery evasion upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2196	attrib.exe

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1876	jaohost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/files/0x000a00000001225e-3.dat	upx
behavioral1/memory/2852-5-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1876-6-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\jaohost.exe	6204288ceceda15b35daa28a01a461d0N.exe
File opened for modification	C:\Windows\Debug\jaohost.exe	attrib.exe
File created	C:\Windows\Debug\jaohost.exe	6204288ceceda15b35daa28a01a461d0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6204288ceceda15b35daa28a01a461d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2852	6204288ceceda15b35daa28a01a461d0N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2196	2852	6204288ceceda15b35daa28a01a461d0N.exe	30
PID 2852 wrote to memory of 2196	2852	6204288ceceda15b35daa28a01a461d0N.exe	30
PID 2852 wrote to memory of 2196	2852	6204288ceceda15b35daa28a01a461d0N.exe	30
PID 2852 wrote to memory of 2196	2852	6204288ceceda15b35daa28a01a461d0N.exe	30
PID 2852 wrote to memory of 2712	2852	6204288ceceda15b35daa28a01a461d0N.exe	33
PID 2852 wrote to memory of 2712	2852	6204288ceceda15b35daa28a01a461d0N.exe	33
PID 2852 wrote to memory of 2712	2852	6204288ceceda15b35daa28a01a461d0N.exe	33
PID 2852 wrote to memory of 2712	2852	6204288ceceda15b35daa28a01a461d0N.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2196	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6204288ceceda15b35daa28a01a461d0N.exe
"C:\Users\Admin\AppData\Local\Temp\6204288ceceda15b35daa28a01a461d0N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\jaohost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\620428~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2712

C:\Windows\Debug\jaohost.exe
C:\Windows\Debug\jaohost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\jaohost.exe

Filesize
163KB

MD5
b27dc16f7160384bec7588b7bc4d0cbd

SHA1
cf3f605fa92a05be221b1e099390adc4e061436e

SHA256
abab6f499a82f9ae04af3a8231d0630e07673e4867562c75205d34027bdd632c

SHA512
a8d7a499e91f648cf8cae94d31a454286cc06f000bf9b78ef90c17ca60e45e81f0740951597d307b9feaff24d8db2fbbaf4fea0680a92c769622c74ba6a88635

Download Submit
memory/1876-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2852-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2852-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads