MALICIOUS — JFNED.exe

MALICIOUS — JFNED.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Razy family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: d106531608f4b3f7ac9f30ac7b80a203eea9644533812e93b5d0c5d8b743cdbf
SHA-1: 042f595e9ba98bbc15a9488e03cc80ffbdcfd8e6
MD5: fba6d7d3c5a6cd1651cad826ab5d45bf
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:vwtzAsKzUq4yvzEkyu4i2aRnocn+7g3i6G5a8413ZnJGdlq4NLthEjQT6j:vwtEsEzY1aB+AyKEqQEj1
TLSH: T1B1428B9C4A6D2A42C9BEC5266E01A85FCAF2A180843C165FC263D23E5DFF43F746444E
Submitted as: JFNED.exe
File type: pe · Size: 212992 bytes
Verdict: malicious (98/100) · Family: Razy

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 33 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

43992 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\WAKEIYY.exe - 96b60e45f137b3a9398b43561ecdf5a6872ab01b75140987fe96af8dbfd7ca3c
C:\Windows\RIDZR.exe - ad7251d1aaa1e98e4d565eef45cae39fccdce4ed306673c61a076fb62354ebf4
C:\Windows\System\PIWZEM.exe - e9eb4946347b5f8dc019ccaf8566cc6ceed703f6842ecff004c07c5bf811466f
C:\Windows\System32\EYNTMW.exe - e7fdf1e65457c453623c7459c5a18a6da36332d9e5aafc88eeb0f74ceb004982
C:\Windows\HYEBJQ.exe - 77bf551063ce663c68c2ee522122350ef6371ab0c5cc9158cff9bd94e6b8ecbe
C:\Windows\System32\FFQNLUO.exe - dcaddcf50553093b66bac06214096d2f573017438ccb578264bc3a18a5e55d4c
C:\Windows\System32\ORTRBW.exe - b4379ead7d3191e4ad0a83c8d8b813a80a088f520a891d3014944f29c9001aab
C:\Windows\MUB.exe - 9b9dae01eae7b4c0634497ec5322c6c7a9ac0e42a556e301adc59c3b3fbec9bc
C:\Windows\WAGP.exe - 05e5aa7e67fd20b4aa805c90c80b2a94e46644044a6df1f17958cae4ed7131e4
C:\Windows\System32\BDU.exe - a1f446dfaa1eecea8bff7b38dd2c9ff13c50928e3bf317c76261ad3d80efec22
C:\Windows\System32\CAWXZ.exe - b616269d9656a6235d7c2c1f38e67ba01fb981cc1a96c0ff04524e0e42d64ffc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787726852&P2=404&P3=2&P4=BnXN4vZjmMKQi0pkVA7y1XrTU%2b%2bAdORx%2b9f5vd%2bDNnAck2kSAhq6yRLCmqfPfUKHcv8n8OLNUBraEUPBObo%2brA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787726914&P2=404&P3=2&P4=jYPoCGGqGlo%2bd%2fp6y0RCqx%2bJ8bs668Iflrz9Fy6a81FehJUmC2e47hgchT%2f15j4utfQ6VcCaEKbpxKogA2FFvw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

135.233.95.80
85.210.196.11
20.184.175.16
203.26.79.13
52.123.252.193
52.123.252.234
4.230.171.124
40.84.85.40
52.253.84.76
74.178.240.61
74.178.240.51
20.42.73.25
20.112.250.133
40.99.133.242
52.123.129.14
52.123.128.14
135.232.92.34
172.66.2.5
162.159.142.9
135.233.45.222
135.233.45.221
135.234.160.245
52.123.252.226
52.148.114.188
135.234.160.246

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report