e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952.exe
Size

233KB
MD5

61a271719df1dac7dc4209e5be41ae00
SHA1

dbcc43843e9d705efea02358d60263a0c93499ad
SHA256

e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952
SHA512

dcb812c47f15e7983817d1440afdce708c284ddca97a871d2de432f1e8e9911a7e50d35402581078f3335f9237b7ac2684cdf95ba748625443167ecc7d39d8db
SSDEEP

6144:mEjpvYc3QxMI7TwmdMlL992VKmKmn1Dk1i7YqysN40m8:xVnB3R2RlYYYqlN48

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	jjruejn.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jjruejn.exe	e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952.exe
File created	C:\PROGRA~3\Mozilla\segfnra.dll	jjruejn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 1724	516	taskeng.exe	28
PID 516 wrote to memory of 1724	516	taskeng.exe	28
PID 516 wrote to memory of 1724	516	taskeng.exe	28
PID 516 wrote to memory of 1724	516	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952.exe
"C:\Users\Admin\AppData\Local\Temp\e434b31fbeb5c8eb256a86f511a904d3cebd4ed02d49839ec1e22bb6de3d6952.exe"
1⤵
- Drops file in Program Files directory
PID:1880

C:\Windows\system32\taskeng.exe
taskeng.exe {85A65E4D-F3DE-4BA4-9A67-A0973EC996AB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\PROGRA~3\Mozilla\jjruejn.exe
  C:\PROGRA~3\Mozilla\jjruejn.exe -npivonl
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
233KB

MD5
fb0b74ae8f3ab26ff1e7b7d0c2806f58

SHA1
0087c9ccccd5af56101962c7976c2acd87c925d1

SHA256
36a7ec3724d9206f86817b7d280d733f497d049943366b8254eb27271f714597

SHA512
1b1c48706f4eeeb4cdf4ff79bd0ff74d293fcc5cd01becf2dd12c3d36bcda3fba14f1c40d0f5f952e5c6bd9ad1cbe665a6414effa2f481226efa33083e38479e

Download Submit
C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
233KB

MD5
fb0b74ae8f3ab26ff1e7b7d0c2806f58

SHA1
0087c9ccccd5af56101962c7976c2acd87c925d1

SHA256
36a7ec3724d9206f86817b7d280d733f497d049943366b8254eb27271f714597

SHA512
1b1c48706f4eeeb4cdf4ff79bd0ff74d293fcc5cd01becf2dd12c3d36bcda3fba14f1c40d0f5f952e5c6bd9ad1cbe665a6414effa2f481226efa33083e38479e

Download Submit
memory/1724-67-0x000000000043A000-0x000000000047D000-memory.dmp

Filesize
268KB

Download
memory/1724-68-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/1880-54-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1880-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1880-56-0x0000000000320000-0x000000000037B000-memory.dmp

Filesize
364KB

Download