Analysis

  • max time kernel
    599s
  • max time network
    423s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 06:14

General

  • Target

    4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe

  • Size

    376KB

  • MD5

    9c458c07ecf18ce7e1c87f4b58e064b9

  • SHA1

    e068bc5ea6978d9292326376edade2ff3e82991a

  • SHA256

    4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9

  • SHA512

    b76d4fa04d50907669426773a347304631d07511a4dff1a8495e2ba30ef7c7446b87d72d45771dcd6072c42f02238e3ca06f48061920a5a5da0c96acb7a5297c

  • SSDEEP

    6144:LD1U5qcLBstYzutk0s82UpRt8yQXs38gdq:LD1NgX0s82Upk0Jd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1988
  • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    1⤵
      PID:1328
    • C:\Windows\system32\sppsvc.exe
      C:\Windows\system32\sppsvc.exe
      1⤵
        PID:1996
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Adds Run key to start application
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
        • C:\Users\Admin\AppData\Local\Temp\4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
          "C:\Users\Admin\AppData\Local\Temp\4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe"
          2⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1764
      • C:\Windows\System32\spoolsv.exe
        C:\Windows\System32\spoolsv.exe
        1⤵
          PID:656

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\JenwAjyi\JenwAjyi.dat

          Filesize

          250KB

          MD5

          db4efe1ecefb18857187379778d999d9

          SHA1

          7967e2c6cf0804b3ff324c7b027d18230de07bcb

          SHA256

          c74a9746ddb5ea2d63d3169d1569a5d89a27a0e9332ecfb94a0888d0fb1409ab

          SHA512

          023f8dbf08153bb46e8b92e47064c6a349893ae1f1bc5f3dfba5977517927d9cf716994a0791e9fb1d53120610306fc07254a34e8a0991245641996b5b887b34

        • \ProgramData\JenwAjyi\JenwAjyi.dat

          Filesize

          250KB

          MD5

          db4efe1ecefb18857187379778d999d9

          SHA1

          7967e2c6cf0804b3ff324c7b027d18230de07bcb

          SHA256

          c74a9746ddb5ea2d63d3169d1569a5d89a27a0e9332ecfb94a0888d0fb1409ab

          SHA512

          023f8dbf08153bb46e8b92e47064c6a349893ae1f1bc5f3dfba5977517927d9cf716994a0791e9fb1d53120610306fc07254a34e8a0991245641996b5b887b34

        • memory/656-61-0x0000000001CA0000-0x0000000001CF4000-memory.dmp

          Filesize

          336KB

        • memory/1212-75-0x0000000002A10000-0x0000000002A64000-memory.dmp

          Filesize

          336KB

        • memory/1212-76-0x0000000002B40000-0x0000000002BAB000-memory.dmp

          Filesize

          428KB

        • memory/1764-54-0x0000000000400000-0x00000000004CF000-memory.dmp

          Filesize

          828KB

        • memory/1764-55-0x0000000076261000-0x0000000076263000-memory.dmp

          Filesize

          8KB

        • memory/1764-56-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1764-59-0x0000000010000000-0x0000000010032000-memory.dmp

          Filesize

          200KB

        • memory/1764-74-0x0000000010000000-0x0000000010042000-memory.dmp

          Filesize

          264KB

        • memory/1764-77-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1764-78-0x0000000010000000-0x0000000010032000-memory.dmp

          Filesize

          200KB