a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2

Analysis

max time kernel
2s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe
Size

111KB
MD5

891ec2f65851d6ecec54ab9ba28f5f7f
SHA1

5484bd239b0abe01b71a53892f1dd7d839bdc53e
SHA256

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2
SHA512

e467cdd3596049d8d5e225d00e1bf5441c847f839630ec2b994370b58a3c39fdaccedec281070750fde4534984ad9bf561ae4301a1ea78d8fe3f9ad8303df42f
SSDEEP

3072:V1EDc6Pgip4D4dMz4n4N4t4R4aEIIIIzcy:V1EDZ1xMdEIIIIzX

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

Executes dropped EXE 1 IoCs

Processes:

juidi.exe

pid process

5080 juidi.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5080	juidi.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exejuidi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	juidi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

pid process

2804 a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

pid	process
2804	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe

description	pid	process	target process
PID 2804 wrote to memory of 5080	2804	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe	juidi.exe
PID 2804 wrote to memory of 5080	2804	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe	juidi.exe
PID 2804 wrote to memory of 5080	2804	a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe	juidi.exe

C:\Users\Admin\AppData\Local\Temp\a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe
"C:\Users\Admin\AppData\Local\Temp\a9bcbf31557835114e4f3e0be46132385646609ff9826b4050952714e978f2f2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\juidi.exe
  "C:\Users\Admin\juidi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\juidi.exe

Filesize
111KB

MD5
71592c0ee46b678639f5f73ba390cc39

SHA1
721b320950e06fc43452bb84331a8deb92d57746

SHA256
bbff07d75ba645dd1b2806b3726b8f5d02b7306f83bf53377de6eb1f5e61db69

SHA512
469acda05d9a1252d84565854ef468c35769a856c85e4f3c3a93d23e4605caed6dba4a8d01c7db6dd6a31f3bb657d052648abf9d0b6e864689c565fdbadbe21f

Download Submit