9b0bfd03394e34336bb2dc5bc9001243a95c553ca2cdaf3d79820787a4e39226

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jetsjets6654.exe
Size

1.2MB
MD5

957242e6d5769a32406189f7f05f50af
SHA1

42297b45d76f9c475842fe6cbc60426aea470d8c
SHA256

3eeec1884c0a7d2c7c49991d08bcf731f563fd55faff77cf02b5c6f73f34b5f1
SHA512

e812a0d87b4c3af2bc2f7c25cb11256414a1b9577e405f8e0cfa86384bbdb998da21fdd015c17c57188db4e107b746acc0d579504b81050c6e1af05b101c305a
SSDEEP

24576:iAOcZXp00Sjm2GbobhjkmK3cLSzv7w84UopeOH+2UNUquptQZCU:oDl44U3hvUUbJZupXU

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	jetsjets6654.exe

Executes dropped EXE 1 IoCs

pid	Process
8	kgxqxqi.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 8 set thread context of 3444	8	kgxqxqi.pif	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	3444	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jetsjets6654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kgxqxqi.pif

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 8	4772	jetsjets6654.exe	83
PID 4772 wrote to memory of 8	4772	jetsjets6654.exe	83
PID 4772 wrote to memory of 8	4772	jetsjets6654.exe	83
PID 8 wrote to memory of 1984	8	kgxqxqi.pif	85
PID 8 wrote to memory of 1984	8	kgxqxqi.pif	85
PID 8 wrote to memory of 1984	8	kgxqxqi.pif	85
PID 8 wrote to memory of 3444	8	kgxqxqi.pif	86
PID 8 wrote to memory of 3444	8	kgxqxqi.pif	86
PID 8 wrote to memory of 3444	8	kgxqxqi.pif	86
PID 8 wrote to memory of 3444	8	kgxqxqi.pif	86

C:\Users\Admin\AppData\Local\Temp\jetsjets6654.exe
"C:\Users\Admin\AppData\Local\Temp\jetsjets6654.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\2_44\kgxqxqi.pif
  "C:\2_44\kgxqxqi.pif" bslxdvw.ewe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 80
      4⤵
      Program crash
      PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3444 -ip 3444
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2_44\ahlaua.wee

Filesize
370KB

MD5
1f7784b35717cf5181ee1c018937792c

SHA1
66d56f668f55e4258f850213229e719b2b01de50

SHA256
a21e8ca9bbb50777a3835572ed47b631721845992ad1023bd71e11850c5f7306

SHA512
1cbc109083f22de2ee7eb43ad1ff601120a3b8e558ad032e58779e91f81b82f38480c2b76eb7ce201102fb8392d3043309e16b6877d4ba4f40e2204822ecf647

Download Submit
C:\2_44\dqpro.mp3

Filesize
37KB

MD5
39dd82a2f9cbca0b7cc3175df545834f

SHA1
e7abbd2ddb91092e5a9eaa8360da0cdc23485781

SHA256
3ee3bb319091cc00f0e950a54f65642878059fb600bc321a2ad8a91aed28375d

SHA512
7e3e43472a184ece773555b9ae3aba6d86fe1466e30d3031dfaa4da3b070fd3e02834faec2523698773a96fd13ef586ab3ba6fe64197abdce307d70da8dc0eb6

Download Submit
C:\2_44\kgxqxqi.pif

Filesize
1.3MB

MD5
92b9ea22338dcd34bc1d8bef60a635a4

SHA1
b7da7f7f1533e073463ba02f986e5c17e15d39c3

SHA256
21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

SHA512
ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

Download Submit