d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7

Analysis

max time kernel
102s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
Size

159KB
MD5

226dece4190c782f6179d9636e3646e0
SHA1

1ab7c2fd1a06447eaf6999010e282a08ad66b264
SHA256

d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7
SHA512

f4f0f2b52362064ab1a8da0e73a9ae6cfd2e7542e42dceebdd3d2096ff9d19ade1206159e4fa301c28b148845363d41e5a9344f5fea9d7b8ad280318d2d876b9
SSDEEP

3072:4ZMJnTeM4cJJHOSxtwbsDHxDYvGw7rgdVikMf7qkIW+K:UeTeM/bOSxusDHRYu6gdVihp

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	jcxb.exe

Loads dropped DLL 6 IoCs

pid	Process
572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
2912	jcxb.exe
2912	jcxb.exe
2912	jcxb.exe
572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000193a0-19.dat	upx
behavioral1/memory/572-25-0x00000000003F0000-0x00000000003FC000-memory.dmp	upx
behavioral1/memory/2912-34-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Funshion Online\Funshion\m	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File opened for modification	C:\Program Files (x86)\Funshion Online\Funshion\m	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\jcxb.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File created	C:\Program Files (x86)\Windows Media Player\jcxb.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File created	C:\Program Files (x86)\Intel\yFMSUL.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jcxb.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000019489-10.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	jcxb.exe
Token: SeDebugPrivilege	2912	jcxb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29
PID 572 wrote to memory of 2912	572	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	29

C:\Users\Admin\AppData\Local\Temp\d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
"C:\Users\Admin\AppData\Local\Temp\d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:572
- C:\Program Files (x86)\Windows Media Player\jcxb.exe
  "C:\Program Files (x86)\Windows Media Player\jcxb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Funshion Online\Funshion\m

Filesize
100KB

MD5
ffa9a7df6480ff67b5492f7a118e1b4b

SHA1
2fdd98953d7dbff5f027cdff4b34f33c90374101

SHA256
9f68c06375e0c5b624e81938ad8df51ea3053b7100c7e96adeee5e5207d2d5c3

SHA512
c90cac6640b7f104903003f3d2adfd7a64aea23e6465e951e155b5616b884b536227ba6b4d8be95bf9f788e607a098606c82e9925136e9397f7fe330f171fb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5D4E.tmp\ioSpecial.ini

Filesize
607B

MD5
8f0eac1fec2806b57cf34c70ef6e6344

SHA1
25b1188103fd2dac9812e1c17a2acde6d55a8256

SHA256
9719fb16d19924332ae1672e5265bb6aa225d904f4bf5c1f15a1ab1cfefd9967

SHA512
861f520389d73cc2b2555e051c35c8b95a8d3ec61717736020cd9e49af130c3e7dd119f8164f600879bd7ed148fe0a17c6ca4c9ccf73c87b9e9ff0a6351e8e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5D4E.tmp\ioSpecial.ini

Filesize
620B

MD5
d35e6f2615466905657d0ec43693efc3

SHA1
07d9991476274088eb37b08e55c71ea2bd7e30f3

SHA256
fb66ff6cd7688d81f5c06d1ff4643aaf8451985412e8d68812359d04f68bdacd

SHA512
2f7876c34def431fdcf9b3461c8a2c410bb7ceccb3b3217c59a3950c1178419e9a69e09f291f429825475931d050641560e003d83ff46d520f941feeeb82cd3d

Download Submit
\Program Files (x86)\Windows Media Player\jcxb.exe

Filesize
12KB

MD5
cac39e1fc84fda5c1179404ea0e7de52

SHA1
8f5ece3b85495dc92c7004d36bf7daa56b3bb43b

SHA256
f457b697c1b74807da7f840a7a927bad817b03d9a19d9b211d3d2c7d5bb9e0cc

SHA512
5227f346bb9eb5a0fac15a700b247f73d7761adfc7190543dd0ac47b0a2882484af705ce03c1fe3da3e2489954e2dcf6add198d0cf6d54b5303a258e3d4a84a3

Download Submit
\Users\Admin\AppData\Local\Temp\nsp5D4E.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
memory/572-21-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/572-25-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/572-107-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2912-33-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/2912-32-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/2912-34-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download