f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48.exe
Size

498KB
MD5

8307f11e116d6fa5290f5b92358182e0
SHA1

b3633dbc5a342ec72ee447d5032afbff9255af24
SHA256

f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48
SHA512

d136215d64b6ea794bc63e31cebda79d15b8e1ca6cbadabb67bdca652905a01adb6ad72021b8f28ab8367784fb3d603257524cf7401392b1670ba8a7b8b6ed1a
SSDEEP

12288:21iSNkjo6dHkM7dTd7g5dtPG6ia5fpJsnr:21iJRkMBp7Wte6sr

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1420	jwufxge.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jwufxge.exe	f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48.exe
File created	C:\PROGRA~3\Mozilla\hvkykah.dll	jwufxge.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1420	1936	taskeng.exe	27
PID 1936 wrote to memory of 1420	1936	taskeng.exe	27
PID 1936 wrote to memory of 1420	1936	taskeng.exe	27
PID 1936 wrote to memory of 1420	1936	taskeng.exe	27

C:\Users\Admin\AppData\Local\Temp\f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48.exe
"C:\Users\Admin\AppData\Local\Temp\f7f434055730468b2d259c9ec079db336f0ef5d2ae38e8cdf98a07873d5a6c48.exe"
1⤵
- Drops file in Program Files directory
PID:1348

C:\Windows\system32\taskeng.exe
taskeng.exe {2A86CF48-86DC-4CEA-BDB4-BE1884E3C0BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\PROGRA~3\Mozilla\jwufxge.exe
  C:\PROGRA~3\Mozilla\jwufxge.exe -kqepohf
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
498KB

MD5
08794c01d13960d9ca064dd8f1f35902

SHA1
72ac8d7316c1b046c15fb49d415504eae0559ca4

SHA256
0c07428a17dbfd2f1e0862e6f5ca95c66144503bbb9727bc0ccbaca60ffd250f

SHA512
57c7b0b3a80abadcf537340692e867cae3c227f2cb32e954042393e9a1fc5f79e4186f828e501a5acc9deef1e2c8fa5e339b21e2eb717aa9c5344f6671f500d5

Download Submit
C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
498KB

MD5
08794c01d13960d9ca064dd8f1f35902

SHA1
72ac8d7316c1b046c15fb49d415504eae0559ca4

SHA256
0c07428a17dbfd2f1e0862e6f5ca95c66144503bbb9727bc0ccbaca60ffd250f

SHA512
57c7b0b3a80abadcf537340692e867cae3c227f2cb32e954042393e9a1fc5f79e4186f828e501a5acc9deef1e2c8fa5e339b21e2eb717aa9c5344f6671f500d5

Download Submit
memory/1348-54-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1348-56-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1348-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download