Overview

overview

8

Static

static

2f49652daa...95.exe

windows7-x64

8

2f49652daa...95.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f49652daadb8d7095d68b7b197b1ffddacef7d4b8e474ebe90d757fb7b02c95.exe

  • Size

    312KB

  • MD5

    07c292f92880addb522d590e7348dad5

  • SHA1

    d7abd9be2cc525ec8ae0c2ba40be8ced272a295d

  • SHA256

    2f49652daadb8d7095d68b7b197b1ffddacef7d4b8e474ebe90d757fb7b02c95

  • SHA512

    cd1d709494816ec17b89a99ace6336c23b5f82af32c8c95c26bbfbb375ce4676cc8f8581ca56e5d4398bd27a64481bb2847604e84721d6092b6f91e8e6f6d263

  • SSDEEP

    6144:doFq9rmpx4faFYRYYWE5MUOJfJZHbj4njCxiyLldZxfsKZTLpE:mqqQSFYRYYWn3l0WxiyheKJL

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f49652daadb8d7095d68b7b197b1ffddacef7d4b8e474ebe90d757fb7b02c95.exe
    "C:\Users\Admin\AppData\Local\Temp\2f49652daadb8d7095d68b7b197b1ffddacef7d4b8e474ebe90d757fb7b02c95.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe
      "C:\ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe" "C:\Users\Admin\AppData\Local\Temp\2f49652daadb8d7095d68b7b197b1ffddacef7d4b8e474ebe90d757fb7b02c95.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe
    Filesize

    312KB

    MD5

    e42cefdfd91c904b9d2d98f9a4b44447

    SHA1

    b77296cb7d7b043e1cd10283f45a553f5d39ae4e

    SHA256

    9b1383015a93d7492f549562306b5641bc0496a831007d0459bb40206298447c

    SHA512

    66cf306076c146b0ebb1fdb258fbab1a536ff585d5fcef3f8fb0bbee3f073bbc8090b97f5204d40a6476ac008f97dcaa642df126bf8263e2963ba5cb2942d36d

    Download Submit

  • C:\ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe
    Filesize

    312KB

    MD5

    e42cefdfd91c904b9d2d98f9a4b44447

    SHA1

    b77296cb7d7b043e1cd10283f45a553f5d39ae4e

    SHA256

    9b1383015a93d7492f549562306b5641bc0496a831007d0459bb40206298447c

    SHA512

    66cf306076c146b0ebb1fdb258fbab1a536ff585d5fcef3f8fb0bbee3f073bbc8090b97f5204d40a6476ac008f97dcaa642df126bf8263e2963ba5cb2942d36d

    Download Submit

  • \ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe
    Filesize

    312KB

    MD5

    e42cefdfd91c904b9d2d98f9a4b44447

    SHA1

    b77296cb7d7b043e1cd10283f45a553f5d39ae4e

    SHA256

    9b1383015a93d7492f549562306b5641bc0496a831007d0459bb40206298447c

    SHA512

    66cf306076c146b0ebb1fdb258fbab1a536ff585d5fcef3f8fb0bbee3f073bbc8090b97f5204d40a6476ac008f97dcaa642df126bf8263e2963ba5cb2942d36d

    Download Submit

  • \ProgramData\jPjCcMlPoFi01804\jPjCcMlPoFi01804.exe
    Filesize

    312KB

    MD5

    e42cefdfd91c904b9d2d98f9a4b44447

    SHA1

    b77296cb7d7b043e1cd10283f45a553f5d39ae4e

    SHA256

    9b1383015a93d7492f549562306b5641bc0496a831007d0459bb40206298447c

    SHA512

    66cf306076c146b0ebb1fdb258fbab1a536ff585d5fcef3f8fb0bbee3f073bbc8090b97f5204d40a6476ac008f97dcaa642df126bf8263e2963ba5cb2942d36d

    Download Submit

  • memory/1668-62-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1668-67-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1668-68-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1672-55-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1672-65-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1672-66-0x0000000002430000-0x0000000002533000-memory.dmp

    Filesize

    1.0MB

    Download