2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4.exe
Size

219KB
MD5

829929444139182ca80f6d42b7e67470
SHA1

f29324561e996f76b0af50997af41b056b0fa26b
SHA256

2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4
SHA512

9d925ad37ce6bcfa8371f09fbdffb4d6dbd212b1ac27149bc7268b927e483493d0468863207d4b560b75cce1dddf8274c4ccf049c4add370d219cb8b2597fcb0
SSDEEP

3072:zu65oMNF6eyu2dlCi520wzhpkX96cYEVuGAboR:zu6yMv6eyuKUiVt6mOboR

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1124	jjruejn.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jjruejn.exe	2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4.exe
File created	C:\PROGRA~3\Mozilla\segfnra.dll	jjruejn.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2032	2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4.exe
1124	jjruejn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1124	1688	taskeng.exe	28
PID 1688 wrote to memory of 1124	1688	taskeng.exe	28
PID 1688 wrote to memory of 1124	1688	taskeng.exe	28
PID 1688 wrote to memory of 1124	1688	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4.exe
"C:\Users\Admin\AppData\Local\Temp\2194bf04af067b53fe692a273373505864826f02f863b1a7114a98cbab9f67a4.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2032

C:\Windows\system32\taskeng.exe
taskeng.exe {8141CB5E-4609-4A22-B5BC-3651B3C4EFD9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\PROGRA~3\Mozilla\jjruejn.exe
  C:\PROGRA~3\Mozilla\jjruejn.exe -npivonl
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
219KB

MD5
39b8eb9013dcc604e58df19e09d6a3d7

SHA1
47e2fbf0719f07c89251fc2d18054e66b4d6221d

SHA256
6cf4cf97b8d96ee4018d7437a330e98a44ca2d6dfc91fb56894dcbca35915e92

SHA512
66e9ab8ff0b8dbb1a8da1bd6f962a6f75675e4423e9ce75a9d20c5905e3edbd527c4356180990be63348321b7878ce58138b9c611a5cc76d57c5d085b6b5c5e9

Download Submit
C:\PROGRA~3\Mozilla\jjruejn.exe

Filesize
219KB

MD5
39b8eb9013dcc604e58df19e09d6a3d7

SHA1
47e2fbf0719f07c89251fc2d18054e66b4d6221d

SHA256
6cf4cf97b8d96ee4018d7437a330e98a44ca2d6dfc91fb56894dcbca35915e92

SHA512
66e9ab8ff0b8dbb1a8da1bd6f962a6f75675e4423e9ce75a9d20c5905e3edbd527c4356180990be63348321b7878ce58138b9c611a5cc76d57c5d085b6b5c5e9

Download Submit
memory/1124-62-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/1124-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1124-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000290000-0x00000000002EB000-memory.dmp

Filesize
364KB

Download
memory/2032-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2032-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download