0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6.exe
Size

194KB
MD5

6eb0a46e32f98dc715b7527755197f50
SHA1

f294b4f7258af6edc3314d674e750531869f330f
SHA256

0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6
SHA512

40882d8bed9edf85730cad8a0a0ab68730f18556ac928d22abd844b0a43c55a6ab75dd208f32a15319284fd419f845960fad3a8994b41881c191e7c8e4fa725c
SSDEEP

3072:QuIcgTsDAJJRjOMCAZ2l/uJrwhGHsVLFZhh2D+0caj3kyRACM:QuIdJJlzhJrzHsVn9ozM

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
908	jwufxge.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jwufxge.exe	0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6.exe
File created	C:\PROGRA~3\Mozilla\hvkykah.dll	jwufxge.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
364	0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6.exe
908	jwufxge.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 908	1708	taskeng.exe	27
PID 1708 wrote to memory of 908	1708	taskeng.exe	27
PID 1708 wrote to memory of 908	1708	taskeng.exe	27
PID 1708 wrote to memory of 908	1708	taskeng.exe	27

C:\Users\Admin\AppData\Local\Temp\0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6.exe
"C:\Users\Admin\AppData\Local\Temp\0e04093788617a061b5d778d50d983313b3c72aac6eb2994fd1f69bfeb6149a6.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:364

C:\Windows\system32\taskeng.exe
taskeng.exe {72B8A792-96E3-4F2A-A712-F716EC16ACBD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\PROGRA~3\Mozilla\jwufxge.exe
  C:\PROGRA~3\Mozilla\jwufxge.exe -kqepohf
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
194KB

MD5
adc6bb1b36714b6a225495b4a2b7aa80

SHA1
3a36dc31665fa327e9b047d60d29089d1361a9c7

SHA256
fe708062fb22f6fcbe77b291bf51530043bfd72032208a1a782e80b1168a1f14

SHA512
6f0ea5f0f6901817c2de850e4844468eed63a3852a0f5c43c272e235d0add9cb07313b1eff8375cfbd3386bf3ae23a2ee152505e70f84a19da3b31b6bd58d48b

Download Submit
C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
194KB

MD5
adc6bb1b36714b6a225495b4a2b7aa80

SHA1
3a36dc31665fa327e9b047d60d29089d1361a9c7

SHA256
fe708062fb22f6fcbe77b291bf51530043bfd72032208a1a782e80b1168a1f14

SHA512
6f0ea5f0f6901817c2de850e4844468eed63a3852a0f5c43c272e235d0add9cb07313b1eff8375cfbd3386bf3ae23a2ee152505e70f84a19da3b31b6bd58d48b

Download Submit
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-55-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/364-56-0x0000000000370000-0x00000000003CB000-memory.dmp

Filesize
364KB

Download
memory/364-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/908-61-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/908-63-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/908-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/908-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download