Overview
overview
10Static
static
10Files.exe
windows7_x64
10Files.exe
windows10-2004_x64
10KRSetp.exe
windows7_x64
6KRSetp.exe
windows10-2004_x64
6agdsk.exe
windows7_x64
10agdsk.exe
windows10-2004_x64
10jg4_4jaa.exe
windows7_x64
7jg4_4jaa.exe
windows10-2004_x64
7pub2.exe
windows7_x64
10pub2.exe
windows10-2004_x64
10pzyh.exe
windows7_x64
8pzyh.exe
windows10-2004_x64
8wf-game.exe
windows7_x64
10wf-game.exe
windows10-2004_x64
7Analysis
-
max time kernel
96s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
08-04-2022 14:03
Static task
static1
Behavioral task
behavioral1
Sample
Files.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
Files.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral3
Sample
KRSetp.exe
Resource
win7-20220331-en
Behavioral task
behavioral4
Sample
KRSetp.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral5
Sample
agdsk.exe
Resource
win7-20220331-en
Behavioral task
behavioral6
Sample
agdsk.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral7
Sample
jg4_4jaa.exe
Resource
win7-20220331-en
Behavioral task
behavioral8
Sample
jg4_4jaa.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral9
Sample
pub2.exe
Resource
win7-20220331-en
Behavioral task
behavioral10
Sample
pub2.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral11
Sample
pzyh.exe
Resource
win7-20220331-en
Behavioral task
behavioral12
Sample
pzyh.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
wf-game.exe
Resource
win7-20220331-en
Behavioral task
behavioral14
Sample
wf-game.exe
Resource
win10v2004-20220331-en
General
-
Target
jg4_4jaa.exe
-
Size
1.0MB
-
MD5
71e6d5725a4495e73c3988a7d61641da
-
SHA1
d087800fd4b040bb346143e496fb816fec18bf68
-
SHA256
adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18
-
SHA512
6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jg4_4jaa.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg4_4jaa.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jg4_4jaa.exedescription pid process Token: SeManageVolumePrivilege 4364 jg4_4jaa.exe Token: SeManageVolumePrivilege 4364 jg4_4jaa.exe Token: SeManageVolumePrivilege 4364 jg4_4jaa.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4364-124-0x0000000003670000-0x0000000003680000-memory.dmpFilesize
64KB
-
memory/4364-130-0x0000000003810000-0x0000000003820000-memory.dmpFilesize
64KB
-
memory/4364-136-0x00000000042C0000-0x00000000042C8000-memory.dmpFilesize
32KB
-
memory/4364-137-0x00000000042E0000-0x00000000042E8000-memory.dmpFilesize
32KB
-
memory/4364-138-0x0000000004740000-0x0000000004748000-memory.dmpFilesize
32KB
-
memory/4364-139-0x0000000004750000-0x0000000004758000-memory.dmpFilesize
32KB
-
memory/4364-140-0x0000000004770000-0x0000000004778000-memory.dmpFilesize
32KB
-
memory/4364-141-0x0000000004B40000-0x0000000004B48000-memory.dmpFilesize
32KB
-
memory/4364-142-0x00000000042E0000-0x00000000042E8000-memory.dmpFilesize
32KB
-
memory/4364-143-0x00000000042E0000-0x00000000042E8000-memory.dmpFilesize
32KB