18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4

Analysis

max time kernel
7s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
Size

500KB
MD5

58be79e04e910cdc25d0353728f95d60
SHA1

e333cf6455416da942cd77a86c40b5b4f55a1a63
SHA256

18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4
SHA512

950787d67e33d113c0bb727a5039ddcb4ff7f336fd1e65c79f803105cb76b0c5f89a518e78b742af4973970aacd25a825ae8b8af5e192cc2e49abd592612c15d
SSDEEP

12288:5MTb0PQ0vyj70pGufmLNMZZW/an1sVsz/:CTb0PQ0vI0LmLiLWCn1

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
2040	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1824	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe

C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
"C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1712 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe" & start C:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:1824
- - C:\Users\Admin\AppData\Local\jnpxmbmea.exe
    C:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f
    3⤵
    PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /pid 1712
1⤵
- Kills process with taskkill
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\jnpxmbmea.exe

Filesize
23KB

MD5
7aa4d9e242d437f0ae7472a94565e0cf

SHA1
30de37ca0243ac7c0733b518816098543556ebfc

SHA256
7d939e4af226deb56b83df2f3b26c1a24adcb46d5087a20c7668f13077215b28

SHA512
99e43c3f68d36da923a65d1c18ce36e461581816d9cf9e2d1094a282d160cba4c8e3d6185a0cd4b74f6d2d699d9610ee1bb720c5942a64778385fbade34aad4a

Download Submit
C:\Users\Admin\AppData\Local\jnpxmbmea.exe

Filesize
16KB

MD5
dde25b695734f4b047572428434acf9c

SHA1
29aa394ebd7cbd92689c08ccee155a64fcf0e0a6

SHA256
64c2504b9e699e81753df8f7d3d4ee5653a2caa922c6fba5f6e68ef83d76ef3d

SHA512
d633c4d12ef474db950a227ebfc26a6f250a1750b8cb97a7f3e2e4e21dd3d2cccf38578c31b4ee616a1f6d1ec0138a721f582ec31d617605d623a065e08e8ae6

Download Submit
\Users\Admin\AppData\Local\jnpxmbmea.exe

Filesize
21KB

MD5
90b1b0764f93e38aaca946ed5d03797c

SHA1
dc4aacfde12b27c06bfc389a4cfe4e6fdfe8c899

SHA256
b752af84e3e24a0670412cdcbd6786db806413658c757de01ad2f8a0f8a0a422

SHA512
176f8003d19f58925389591a52a1b9609a0c999fafe9cb0f110d28af00aed2b36d8625f3c19dee907f6a7180b2243d10cf088e330514dc384deae0150b9e1038

Download Submit
\Users\Admin\AppData\Local\jnpxmbmea.exe

Filesize
28KB

MD5
1d10ea226b7f34e3a9a70f1a5563e8fd

SHA1
2266185822d46fa6b6ffc022f1ab0c508b07568a

SHA256
d475b4fd671468871cc883bcad813fefa725a306b3a02f2b0d08df4df4a39424

SHA512
138dda9803746b12224ed01317483eafb9f566f8b0eefa60838e6a2cfb5a18f2867dea7164f0925fcaa1d501b1b9164852d2557d3889c0f8fac4732771d729be

Download Submit
memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1712-58-0x0000000001000000-0x00000000010A9000-memory.dmp

Filesize
676KB

Download
memory/1712-57-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download