832e06a61add7817a67de98b9a7bb8eb8dcb89d3ee557920a3dc96d63a3238d2

General

Target

ChromeStdSetup.exe
Size

27.6MB
MD5

f5352630a4c4764d378d500680cd9f64
SHA1

ce80f5aa2c68cfcdd5be492b3d01f2ca31f1138f
SHA256

832e06a61add7817a67de98b9a7bb8eb8dcb89d3ee557920a3dc96d63a3238d2
SHA512

190c9fd632419600597abd2d29a02f73c976214e4fa4ffaf07f5ace920722adcaf9820f0b73d7c9bad0e0b99c612c2147de62d07036b2a375beffd7e89c211c3
SSDEEP

786432:Tbnq/vxsj6yVAqOu3T4katyXX21qyNPoBe/PFd:C/Js3VAqOuAajyeBs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1692	wtepktomp.exe
2788	ChromeSetup.exe
13588	Jkcdt.exe
14876	Jkcdt.exe

Loads dropped DLL 4 IoCs

pid	Process
1748	ChromeStdSetup.exe
1748	ChromeStdSetup.exe
1748	ChromeStdSetup.exe
1748	ChromeStdSetup.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Jkcdt.exe
File opened (read-only)	\??\S:	Jkcdt.exe
File opened (read-only)	\??\T:	Jkcdt.exe
File opened (read-only)	\??\U:	Jkcdt.exe
File opened (read-only)	\??\Z:	Jkcdt.exe
File opened (read-only)	\??\E:	Jkcdt.exe
File opened (read-only)	\??\J:	Jkcdt.exe
File opened (read-only)	\??\L:	Jkcdt.exe
File opened (read-only)	\??\H:	Jkcdt.exe
File opened (read-only)	\??\I:	Jkcdt.exe
File opened (read-only)	\??\K:	Jkcdt.exe
File opened (read-only)	\??\R:	Jkcdt.exe
File opened (read-only)	\??\V:	Jkcdt.exe
File opened (read-only)	\??\X:	Jkcdt.exe
File opened (read-only)	\??\Y:	Jkcdt.exe
File opened (read-only)	\??\M:	Jkcdt.exe
File opened (read-only)	\??\N:	Jkcdt.exe
File opened (read-only)	\??\P:	Jkcdt.exe
File opened (read-only)	\??\W:	Jkcdt.exe
File opened (read-only)	\??\B:	Jkcdt.exe
File opened (read-only)	\??\G:	Jkcdt.exe
File opened (read-only)	\??\O:	Jkcdt.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jkcdt.exe	wtepktomp.exe
File opened for modification	C:\Windows\SysWOW64\Jkcdt.exe	wtepktomp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
1692	wtepktomp.exe
1692	wtepktomp.exe
13588	Jkcdt.exe
1692	wtepktomp.exe
13588	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeStdSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtepktomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkcdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkcdt.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
14864	cmd.exe
6580	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jkcdt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Jkcdt.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Jkcdt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Jkcdt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jkcdt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Jkcdt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Jkcdt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	Jkcdt.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6580	PING.EXE

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe
14876	Jkcdt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1692	wtepktomp.exe
Token: 33	14876	Jkcdt.exe
Token: SeIncBasePriorityPrivilege	14876	Jkcdt.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1692	1748	ChromeStdSetup.exe	30
PID 1748 wrote to memory of 1692	1748	ChromeStdSetup.exe	30
PID 1748 wrote to memory of 1692	1748	ChromeStdSetup.exe	30
PID 1748 wrote to memory of 1692	1748	ChromeStdSetup.exe	30
PID 13588 wrote to memory of 14876	13588	Jkcdt.exe	35
PID 13588 wrote to memory of 14876	13588	Jkcdt.exe	35
PID 13588 wrote to memory of 14876	13588	Jkcdt.exe	35
PID 13588 wrote to memory of 14876	13588	Jkcdt.exe	35
PID 1692 wrote to memory of 14864	1692	wtepktomp.exe	34
PID 1692 wrote to memory of 14864	1692	wtepktomp.exe	34
PID 1692 wrote to memory of 14864	1692	wtepktomp.exe	34
PID 1692 wrote to memory of 14864	1692	wtepktomp.exe	34
PID 14864 wrote to memory of 6580	14864	cmd.exe	37
PID 14864 wrote to memory of 6580	14864	cmd.exe	37
PID 14864 wrote to memory of 6580	14864	cmd.exe	37
PID 14864 wrote to memory of 6580	14864	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\ChromeStdSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeStdSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\wtepktomp.exe
  "C:\Users\Admin\AppData\Local\Temp\wtepktomp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\WTEPKT~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:14864
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6580
- C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:2788

C:\Windows\SysWOW64\Jkcdt.exe
C:\Windows\SysWOW64\Jkcdt.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:13588
- C:\Windows\SysWOW64\Jkcdt.exe
  C:\Windows\SysWOW64\Jkcdt.exe -acsi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:14876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

Filesize
8.5MB

MD5
cd32eed7ff292c4be642d7effbcb7a81

SHA1
168b1c3861b0ff480250284b70a6d57b8852a629

SHA256
2e8957863173f7c3ce0e966b7683c04c16c01bdd78e41b6dc2a4b91a1d8f9181

SHA512
597dd3315a05a0dc28a9fd31b24afbe4f6d2094fc95e8c3b5724368d5a15c97ad71c9dee178ae8ef467a32d8bc8aee304bb1b8e560bc964183ff1eaa610f83de

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSWWpOOCvT0g70l.exe

Filesize
5.8MB

MD5
82b07eaf5b509df826c8a9268df0fb16

SHA1
1151a73ff6ff839f48f7f0d46e343b41c1ccd53b

SHA256
63cc4a2c48ede5aae448420f6ccefb9b7fd4739f6ce17733b453e804ba91977f

SHA512
065198bb5413029daad01edb7aa8bf7d70fcab71aeb8e7638f2493d63c6da1efecf0f7df9ffd96586c51317626f9b36ab86e9cdc9a65e3ce86808f24d9269988

Download Submit
\Users\Admin\AppData\Local\Temp\wtepktomp.exe

Filesize
27.6MB

MD5
4ce843f56cbad3ab43caec3ba7f6071d

SHA1
999ecf6203235a3efc3ffa2d599ac4b4ad3e3c2a

SHA256
ae783b3c7bcb5ea06fb5eb671da35cbab84fed9ce035c3a322733f409d1dbebe

SHA512
fc5992edb859c064a31128dc227158d79d29446d1036c453513e01ba201364b20be118243a36fffdd3deb8f3ec1da85a0896edc99e2de9e4dcdeaf49131e5b96

Download Submit
memory/1692-891-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-871-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-840-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-30-0x00000000769B0000-0x00000000769F7000-memory.dmp

Filesize
284KB

Download
memory/1692-901-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-855-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-851-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-849-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-847-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-845-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-843-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-899-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-897-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-895-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-893-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-841-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-887-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-853-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-865-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-883-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-881-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-879-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-877-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-875-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-873-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-889-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-869-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-867-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-885-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-863-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-861-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-859-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1692-857-0x0000000003CB0000-0x0000000003DC1000-memory.dmp

Filesize
1.1MB

Download
memory/1748-25-0x0000000005780000-0x0000000007322000-memory.dmp

Filesize
27.6MB

Download
memory/1748-24-0x0000000005780000-0x0000000007322000-memory.dmp

Filesize
27.6MB

Download
memory/1748-23-0x0000000005780000-0x0000000007322000-memory.dmp

Filesize
27.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads