Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe
-
Size
204KB
-
MD5
d5cf9f9aba4bbf387c22c9f25b267294
-
SHA1
ad7e76eb794cb45bda8d8ff3c35299342844af5c
-
SHA256
24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880
-
SHA512
524f29e9c3762b1ece14980465e29a5122a79f25048a08ddd58420cf2b4fc0a6e161323e1a3660eb3011c3a194ab23a733af59da2f131d75494b63cba8834e1e
-
SSDEEP
3072:amlW8p0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWqvB:V0O4QxL7B9W0c1RCzR/fSmlXB
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jjjem.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 jjjem.exe -
Loads dropped DLL 2 IoCs
pid Process 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /r" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /s" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /q" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /j" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /x" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /m" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /e" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /n" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /a" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /d" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /h" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /v" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /c" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /f" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /z" 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /w" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /t" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /i" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /p" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /o" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /l" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /z" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /u" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /k" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /y" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /g" jjjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\jjjem = "C:\\Users\\Admin\\jjjem.exe /b" jjjem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjem.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe 2740 jjjem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 2740 jjjem.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2740 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 30 PID 2864 wrote to memory of 2740 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 30 PID 2864 wrote to memory of 2740 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 30 PID 2864 wrote to memory of 2740 2864 24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe"C:\Users\Admin\AppData\Local\Temp\24f066d9e9ab486f3287f36793869289dd461d5c3b1e229034a9b77fd9edf880.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\jjjem.exe"C:\Users\Admin\jjjem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD580097bdf2d154ce571abc7e465c7b3b4
SHA14eaafb238e54d57930a5a454f63424c568285ae2
SHA25691280c83cf97760ded7ea8bac92a351cdbbec2fed0f6d3252ae9596611f26dfc
SHA512c4f811f136fb64f84afe429404042f8f0a9ae6f817ab10d5e40a766eb5126e02cac22319627bf4775383fb59806b5020e74112c558a673ed1ddae66a5a19ef0e