ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f

Analysis

max time kernel
29s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f.exe
Size

175KB
MD5

5ffae7109b7b19beb255e945dbe2a0e0
SHA1

6d075a30725c17ea61a3ff13e413ebc352065579
SHA256

ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f
SHA512

f9b073b0eb94a04c80d9581997b21c27c57a4c2babfd319d51518e77660c7ae3764c0f722da17d648a9632dcb38fd7312af0749103ebc5b1fb218bfa2da6e018
SSDEEP

3072:SGxOwEI4rrlYORpXxjgk5R9/2tlqy8eoTqvnBLhzcSo3hcccK+XjNBDUwPPNax:ROwmR/pMk9+tcyDxvBdzcpaUwFax

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	jwufxge.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jwufxge.exe	ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f.exe
File created	C:\PROGRA~3\Mozilla\hvkykah.dll	jwufxge.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
836	ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f.exe
544	jwufxge.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 544	2040	taskeng.exe	28
PID 2040 wrote to memory of 544	2040	taskeng.exe	28
PID 2040 wrote to memory of 544	2040	taskeng.exe	28
PID 2040 wrote to memory of 544	2040	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f.exe
"C:\Users\Admin\AppData\Local\Temp\ea650b6ae1136d8d3167f57e9a803afaaeeed4e6c1321ea39762439651f7964f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:836

C:\Windows\system32\taskeng.exe
taskeng.exe {412D1F29-4DE1-4FCC-BF65-DA5F8A86D3EA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\PROGRA~3\Mozilla\jwufxge.exe
  C:\PROGRA~3\Mozilla\jwufxge.exe -kqepohf
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
175KB

MD5
fce8cc2f5a8ae0e707196c8c70cbec71

SHA1
b5c7c4120d53213e8ae012d5fe62862324215bad

SHA256
808508d1d6bdba9247204b47f2bd19bb2af710506c115ff627916b209b5b4e7a

SHA512
be17a35accea00db32eb1f3a2a97224633b8a7f6513870db1e5004b19cc66c2390372dacbd2e121f169f919fb69ebd8dd7e59a9d69b5db40a6e4a44a2774d471

Download Submit
C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
175KB

MD5
fce8cc2f5a8ae0e707196c8c70cbec71

SHA1
b5c7c4120d53213e8ae012d5fe62862324215bad

SHA256
808508d1d6bdba9247204b47f2bd19bb2af710506c115ff627916b209b5b4e7a

SHA512
be17a35accea00db32eb1f3a2a97224633b8a7f6513870db1e5004b19cc66c2390372dacbd2e121f169f919fb69ebd8dd7e59a9d69b5db40a6e4a44a2774d471

Download Submit
memory/544-62-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/544-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/544-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/836-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/836-55-0x00000000002B0000-0x000000000030B000-memory.dmp

Filesize
364KB

Download
memory/836-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/836-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download