Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 04:33

General

  • Target

    JJSploit_8.10.10_x64_en-US (1).msi

  • Size

    5.0MB

  • MD5

    8cb1e85b5723e3d186cc1742b6c71122

  • SHA1

    f4638a9849b2bea46c8120930c7727cfae70b4d2

  • SHA256

    f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

  • SHA512

    b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b

  • SSDEEP

    98304:6jmBVvK7NEfE6nal/6r5mzaB325gGiU9fh8ztt8xuvuUnm18uHwCEtFW+VAv8m:srNEfulImzfh8IquKq8uA

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 12 IoCs
  • Loads dropped DLL 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\JJSploit_8.10.10_x64_en-US (1).msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1696
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Loads dropped DLL
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DB03F489A82752A4A42457B699428C34 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2872
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1212
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2756
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D0" "00000000000003D8"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

            Filesize

            1KB

            MD5

            146d45483c0a200982440d90ba8e0098

            SHA1

            8938270878b587a30b447970ce6c238e8d59f826

            SHA256

            c80c9c79aa936b4ce03dcd970e05c49aa4192ab27dad72237fe87493d37d7093

            SHA512

            9a1bfbb3cb77a4c0c79cf04b4db405eb225924c17ad7f7d7944cda76be0152021dd4d36786fa3333f604f051f9352c41806e575622d761262ecfd76b40b8ed37

          • C:\Users\Admin\AppData\Local\Temp\MSIA65D.tmp

            Filesize

            132KB

            MD5

            cfbb8568bd3711a97e6124c56fcfa8d9

            SHA1

            d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

            SHA256

            7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

            SHA512

            860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

          • C:\Windows\Installer\f76c9a5.msi

            Filesize

            5.0MB

            MD5

            8cb1e85b5723e3d186cc1742b6c71122

            SHA1

            f4638a9849b2bea46c8120930c7727cfae70b4d2

            SHA256

            f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

            SHA512

            b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b

          • \Program Files\JJSploit\JJSploit.exe

            Filesize

            9.7MB

            MD5

            8c6a8bfd1adf6ccdfe9b65b514479ec7

            SHA1

            08f64d25974040ade826f0c79fd638c6a67627c1

            SHA256

            097eb40a9a1572788272298f48748e80053c9e83f2734387728ea689afc9bfa4

            SHA512

            8ca0ff01add66e8a5fc7db5cbee09fdf2aeda2026c7787370d6d8831c86b504bd50c587bea8ef32fb57f44ea4d9366d456fa071c30ae85708326529cb2800791

          • memory/1212-63-0x000000001B720000-0x000000001BA02000-memory.dmp

            Filesize

            2.9MB

          • memory/1212-64-0x0000000002760000-0x0000000002768000-memory.dmp

            Filesize

            32KB