f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051.exe
Size

166KB
MD5

a1dda39d4e85c4a3d76db7579c564b90
SHA1

ddb49c805c017b70b7a22fb888fd58f971a3d397
SHA256

f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051
SHA512

d6ac8e8a77369f38f676e271c62bed7bec251754dcc4bd95ee93cc3f780a523a287f6824ba539d4b2d4ae9c14fc09034217721cfdbbc891ead762544d1931b4f
SSDEEP

3072:olLCHXaCdhv4DVwveIa1PU1hN6OhFHU1XsQoTN3uDuFdUsu1oMyQ:4Cv3W71PUJ6OhFHU+QSNHRc

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1704	jjruejn.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jjruejn.exe	f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051.exe
File created	C:\PROGRA~3\Mozilla\segfnra.dll	jjruejn.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	jjruejn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1704	2032	taskeng.exe	28
PID 2032 wrote to memory of 1704	2032	taskeng.exe	28
PID 2032 wrote to memory of 1704	2032	taskeng.exe	28
PID 2032 wrote to memory of 1704	2032	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051.exe
"C:\Users\Admin\AppData\Local\Temp\f690a7212b79e89a4905e6e2f02cc968e6b579a7e0c22ebcab5e894991741051.exe"
1⤵
- Drops file in Program Files directory
- Enumerates system info in registry
PID:1416

C:\Windows\system32\taskeng.exe
taskeng.exe {062F8956-B5D5-4C4F-81CC-1F23CEB99284} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\PROGRA~3\Mozilla\jjruejn.exe
  C:\PROGRA~3\Mozilla\jjruejn.exe -npivonl
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Enumerates system info in registry
  PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
166KB

MD5
dc92219b906f02c92fdcb1aa523f98d6

SHA1
45c3f9766613de4486bcab4e04cd9f3c4b3e1f91

SHA256
fa3fc955be67a069ad3c8baa3a4d396a5722abf2f7e701f63c2dc370e869a7a0

SHA512
6ce014e1279d2a3d83e5bf46662c76e7ef7cfb5fc4d62fc120a42ec9b9fedfcf4bef0ac7e9d10d37238acab72a22f1dcfe98bc5b1f731f4fc98df72f06c6f0db

Download Submit
C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
166KB

MD5
dc92219b906f02c92fdcb1aa523f98d6

SHA1
45c3f9766613de4486bcab4e04cd9f3c4b3e1f91

SHA256
fa3fc955be67a069ad3c8baa3a4d396a5722abf2f7e701f63c2dc370e869a7a0

SHA512
6ce014e1279d2a3d83e5bf46662c76e7ef7cfb5fc4d62fc120a42ec9b9fedfcf4bef0ac7e9d10d37238acab72a22f1dcfe98bc5b1f731f4fc98df72f06c6f0db

Download Submit
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x0000000000390000-0x00000000003EB000-memory.dmp

Filesize
364KB

Download
memory/1704-64-0x0000000000880000-0x00000000008DB000-memory.dmp

Filesize
364KB

Download