b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93

Analysis

max time kernel
6s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
Size

90KB
MD5

f65a70dc053741f96ebbaf1a1610b6fe
SHA1

0a571fba3cffc7acdbeb20d5e2ffad65d267726a
SHA256

b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93
SHA512

3dade75764a8b3f9dfb27aa678562465ed16fb61d337c11817256b2bbefe3df0afb2f9604a6fa5cb1f94b5693b2784e856c0a4043f6279778289a1000a437af7
SSDEEP

1536:FAH+3qMB1do0l7q4TKztV+KOAc1JldB5b0g7gtjhEGp:Yk68VTgoxAc1HdB5bAjhEGp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2008	jahjah09.exe
1964	jahjah09.exe

Deletes itself 1 IoCs

pid	Process
2008	jahjah09.exe

Loads dropped DLL 5 IoCs

pid	Process
1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
2008	jahjah09.exe
1964	jahjah09.exe
1964	jahjah09.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\jahjah09.exe	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
File opened for modification	C:\Windows\SysWOW64\mgt09004.ocx	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
File opened for modification	C:\Windows\SysWOW64\mgt99008.ocx	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
File created	C:\Windows\SysWOW64\jahjah09.exe	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fonts\mgt09004.ttf	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
File created	C:\Windows\fonts\mgt09004.ttf	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
2008	jahjah09.exe
2008	jahjah09.exe
2008	jahjah09.exe
2008	jahjah09.exe
2008	jahjah09.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2008	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	27
PID 1996 wrote to memory of 2008	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	27
PID 1996 wrote to memory of 2008	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	27
PID 1996 wrote to memory of 2008	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	27
PID 1996 wrote to memory of 1964	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	28
PID 1996 wrote to memory of 1964	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	28
PID 1996 wrote to memory of 1964	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	28
PID 1996 wrote to memory of 1964	1996	b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe	28

C:\Users\Admin\AppData\Local\Temp\b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
"C:\Users\Admin\AppData\Local\Temp\b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\jahjah09.exe
  C:\Windows\system32\jahjah09.exe C:\Windows\system32\mgt09004.ocx pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\b4228f219d46bf7405b2cfb7be4a89ee351e17808f400b6c2b7c1ee74b7f9a93.exe
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Windows\SysWOW64\jahjah09.exe
  C:\Windows\system32\jahjah09.exe C:\Windows\system32\mgt99008.ocx pfjieaoidjglkajd
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\jahjah09.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\SysWOW64\jahjah09.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\SysWOW64\jahjah09.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\SysWOW64\mgt09004.ocx

Filesize
66KB

MD5
419b3a61edb5046fee2c19f72a30baf6

SHA1
350697809c081fb7eea19cae816ab2e6a238dad2

SHA256
8802bd6226c221c34c5c8e47a8117e4a11757ac130c8f866c7915286d979c13a

SHA512
c0e41a7ae6c5c9a67eec1184ceb4f025a68af46b2c89b1618658ce1d5efd277c2e6c0be4b655a7c5b9958839f65ecf03b5312cfbb5f424d8c13b79df6cce09d3

Download Submit
C:\Windows\SysWOW64\mgt99008.ocx

Filesize
13KB

MD5
71b5c3b5f1f6f7d8d12d138f6e0ad4f4

SHA1
9b0dbb387d894af551c6cbe8c7e25b48a1ee2fa9

SHA256
86386e1b7f93f399f65d021d5b73402c3f1220aac5fb44c00a28f82e0b744862

SHA512
5a9418de813712ef14f474a3499165b4b36fa0043b670d9a7f5e8fad7dfb10203f669e6d4127adc318e1d693909ee36ef6a9595134736728947b930d173dea32

Download Submit
C:\Windows\fonts\mgt09004.ttf

Filesize
412B

MD5
033445f92646bfcf21135560b8488eae

SHA1
a953f4642a4e32a8889e11110af344cab3716f8f

SHA256
3dc92c2390bcc3fce351da7c4d2fb7b48596005f9c735db5a3c4383abd86f5e6

SHA512
614418a3a53fcbcb3e71e232476ba866ef8e15090e35e7c04d586937277ad1bc408732e40ac49921cac6eb80906220a3375dfe70aadb1192f63c5da4bcbaaaec

Download Submit
\Windows\SysWOW64\jahjah09.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Windows\SysWOW64\jahjah09.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Windows\SysWOW64\mgt09004.ocx

Filesize
66KB

MD5
419b3a61edb5046fee2c19f72a30baf6

SHA1
350697809c081fb7eea19cae816ab2e6a238dad2

SHA256
8802bd6226c221c34c5c8e47a8117e4a11757ac130c8f866c7915286d979c13a

SHA512
c0e41a7ae6c5c9a67eec1184ceb4f025a68af46b2c89b1618658ce1d5efd277c2e6c0be4b655a7c5b9958839f65ecf03b5312cfbb5f424d8c13b79df6cce09d3

Download Submit
\Windows\SysWOW64\mgt09004.ocx

Filesize
66KB

MD5
419b3a61edb5046fee2c19f72a30baf6

SHA1
350697809c081fb7eea19cae816ab2e6a238dad2

SHA256
8802bd6226c221c34c5c8e47a8117e4a11757ac130c8f866c7915286d979c13a

SHA512
c0e41a7ae6c5c9a67eec1184ceb4f025a68af46b2c89b1618658ce1d5efd277c2e6c0be4b655a7c5b9958839f65ecf03b5312cfbb5f424d8c13b79df6cce09d3

Download Submit
\Windows\SysWOW64\mgt99008.ocx

Filesize
13KB

MD5
71b5c3b5f1f6f7d8d12d138f6e0ad4f4

SHA1
9b0dbb387d894af551c6cbe8c7e25b48a1ee2fa9

SHA256
86386e1b7f93f399f65d021d5b73402c3f1220aac5fb44c00a28f82e0b744862

SHA512
5a9418de813712ef14f474a3499165b4b36fa0043b670d9a7f5e8fad7dfb10203f669e6d4127adc318e1d693909ee36ef6a9595134736728947b930d173dea32

Download Submit
memory/1964-68-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1964-69-0x0000000001DE0000-0x0000000001FF6000-memory.dmp

Filesize
2.1MB

Download
memory/1996-66-0x0000000000400000-0x000000000061B000-memory.dmp

Filesize
2.1MB

Download
memory/2008-70-0x0000000010000000-0x0000000010216000-memory.dmp

Filesize
2.1MB

Download