d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
Size

159KB
MD5

226dece4190c782f6179d9636e3646e0
SHA1

1ab7c2fd1a06447eaf6999010e282a08ad66b264
SHA256

d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7
SHA512

f4f0f2b52362064ab1a8da0e73a9ae6cfd2e7542e42dceebdd3d2096ff9d19ade1206159e4fa301c28b148845363d41e5a9344f5fea9d7b8ad280318d2d876b9
SSDEEP

3072:4ZMJnTeM4cJJHOSxtwbsDHxDYvGw7rgdVikMf7qkIW+K:UeTeM/bOSxusDHRYu6gdVihp

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1204	jcxb.exe

Loads dropped DLL 1 IoCs

pid	Process
4928	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023ca7-21.dat	upx
behavioral2/memory/1204-22-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/1204-24-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\jcxb.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File created	C:\Program Files (x86)\Intel\yFMSUL.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File created	C:\Program Files (x86)\Funshion Online\Funshion\m	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File opened for modification	C:\Program Files (x86)\Funshion Online\Funshion\m	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\jcxb.exe	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jcxb.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023cac-10.dat	nsis_installer_2

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	jcxb.exe
Token: SeDebugPrivilege	1204	jcxb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1204	4928	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	85
PID 4928 wrote to memory of 1204	4928	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	85
PID 4928 wrote to memory of 1204	4928	d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe	85

C:\Users\Admin\AppData\Local\Temp\d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe
"C:\Users\Admin\AppData\Local\Temp\d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Windows Media Player\jcxb.exe
  "C:\Program Files (x86)\Windows Media Player\jcxb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Funshion Online\Funshion\m

Filesize
100KB

MD5
ffa9a7df6480ff67b5492f7a118e1b4b

SHA1
2fdd98953d7dbff5f027cdff4b34f33c90374101

SHA256
9f68c06375e0c5b624e81938ad8df51ea3053b7100c7e96adeee5e5207d2d5c3

SHA512
c90cac6640b7f104903003f3d2adfd7a64aea23e6465e951e155b5616b884b536227ba6b4d8be95bf9f788e607a098606c82e9925136e9397f7fe330f171fb60

Download Submit
C:\Program Files (x86)\Windows Media Player\jcxb.exe

Filesize
12KB

MD5
cac39e1fc84fda5c1179404ea0e7de52

SHA1
8f5ece3b85495dc92c7004d36bf7daa56b3bb43b

SHA256
f457b697c1b74807da7f840a7a927bad817b03d9a19d9b211d3d2c7d5bb9e0cc

SHA512
5227f346bb9eb5a0fac15a700b247f73d7761adfc7190543dd0ac47b0a2882484af705ce03c1fe3da3e2489954e2dcf6add198d0cf6d54b5303a258e3d4a84a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyA7F9.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyA7F9.tmp\ioSpecial.ini

Filesize
646B

MD5
5e0f1b0c022fcf20005e6d2b3e722a95

SHA1
658fca894e3a492dcd617f248181e869debdeb7f

SHA256
ae9ea5d657715960dd816cfc47c5203a2c412f6ea2114ae6eebd6492bac8234f

SHA512
1106800f9197f6a3264db93376b7a9f3faf604d933705d523ce1f236f3f46b8eafefee47edcd6c044f04066ec2d077377b45efd762807ecfd5c5b9f7c2d0628e

Download Submit
memory/1204-22-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1204-24-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download