c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066.exe
Size

131KB
MD5

60f84ed9b140e85faf127a8ca438043d
SHA1

f19b6d1025c811acb8854296934ce6b050fb6af9
SHA256

c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066
SHA512

ea9d98aeca0c57d5e4e826b9df2735464630ddc01c477d48fb5225d7f008b8dd39075e8838d0aa3dada93c70244b383849d1b239d58c1c84eed1522d9f8fc8ec
SSDEEP

3072:1jxhM3kZOI2/Fs+fYLl288tOfk2MFVuIQ0DYpwm:Fxh9XRXLl2KfDWuIQ0Mpwm

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	jjruejn.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jjruejn.exe	c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066.exe
File created	C:\PROGRA~3\Mozilla\segfnra.dll	jjruejn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1732	1872	taskeng.exe	27
PID 1872 wrote to memory of 1732	1872	taskeng.exe	27
PID 1872 wrote to memory of 1732	1872	taskeng.exe	27
PID 1872 wrote to memory of 1732	1872	taskeng.exe	27

C:\Users\Admin\AppData\Local\Temp\c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066.exe
"C:\Users\Admin\AppData\Local\Temp\c0850b1bcf226b6f3500cf3235e78b8fa00e51db29de5a14c1dc5f9d44c44066.exe"
1⤵
- Drops file in Program Files directory
PID:1376

C:\Windows\system32\taskeng.exe
taskeng.exe {981D5DE6-BE12-40F8-9170-E01C780BC55F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\PROGRA~3\Mozilla\jjruejn.exe
  C:\PROGRA~3\Mozilla\jjruejn.exe -npivonl
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
131KB

MD5
58b1bbdc777f2ac62785622c7ea76356

SHA1
fc6b01721f6c99b68deaf593726814e943230619

SHA256
0eff917b57805d6e7c61a237172b6a5ddb2fe0a4aef2e52b60453b0d2d567212

SHA512
d0df968b4f29492e2e392644e72f14c51e7759325a0ca9c2202098bae208ddcf9ceee06e1e46b0a75c18ce428fcf5bfdf1de9e325da53edc036b6e88a83b1340

Download Submit
C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
131KB

MD5
58b1bbdc777f2ac62785622c7ea76356

SHA1
fc6b01721f6c99b68deaf593726814e943230619

SHA256
0eff917b57805d6e7c61a237172b6a5ddb2fe0a4aef2e52b60453b0d2d567212

SHA512
d0df968b4f29492e2e392644e72f14c51e7759325a0ca9c2202098bae208ddcf9ceee06e1e46b0a75c18ce428fcf5bfdf1de9e325da53edc036b6e88a83b1340

Download Submit
memory/1376-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1376-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000000380000-0x00000000003DB000-memory.dmp

Filesize
364KB

Download
memory/1732-62-0x0000000000000000-mapping.dmp

Download
memory/1732-65-0x00000000008D0000-0x000000000092B000-memory.dmp

Filesize
364KB

Download