7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674.exe
Size

260KB
MD5

0670402b8a914ffca2e2ed1bb4526360
SHA1

0ed8775de3a60935402ae3037c33e4864a09940e
SHA256

7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674
SHA512

c39df4c93214dc50a84549b51359e774138d0e3a5370caf2623f78b18e193958ef04b07ef61f5f3f1dda48d61fd33553430f3834010302c2fcafe59a8c3eb8f4
SSDEEP

6144:USH4NMEb+Or4GO30OZ98XdIPxXnlw/xfnj5htUZ:USH9Eb+E4hRZ98XdoJ4j5ha

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
908	jwufxge.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jwufxge.exe	7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674.exe
File created	C:\PROGRA~3\Mozilla\hvkykah.dll	jwufxge.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1612	7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674.exe
908	jwufxge.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 908	1948	taskeng.exe	27
PID 1948 wrote to memory of 908	1948	taskeng.exe	27
PID 1948 wrote to memory of 908	1948	taskeng.exe	27
PID 1948 wrote to memory of 908	1948	taskeng.exe	27

C:\Users\Admin\AppData\Local\Temp\7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674.exe
"C:\Users\Admin\AppData\Local\Temp\7f77207ad603aaf287fdbf8f05fb16e65b78515a20163313caaa6a214a770674.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1612

C:\Windows\system32\taskeng.exe
taskeng.exe {72B8A792-96E3-4F2A-A712-F716EC16ACBD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\PROGRA~3\Mozilla\jwufxge.exe
  C:\PROGRA~3\Mozilla\jwufxge.exe -kqepohf
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
260KB

MD5
521a5aa616ed91d05c8280201885e656

SHA1
bf1dd57cd8bfdd188c7c8bc687cf8c6e258156dc

SHA256
121cd83d3079f9ee76938c52f86934720ee79484331cc44c619e1541c1907c78

SHA512
0c107ae23366af34d4541d87eaed4de93b898147cd5bf68f7ded073a53500c4167a8971a2c26226d8f74d09eff1134a798bc882292c66884393feb18c1ceb989

Download Submit
C:\PROGRA~3\Mozilla\jwufxge.exe

Filesize
260KB

MD5
521a5aa616ed91d05c8280201885e656

SHA1
bf1dd57cd8bfdd188c7c8bc687cf8c6e258156dc

SHA256
121cd83d3079f9ee76938c52f86934720ee79484331cc44c619e1541c1907c78

SHA512
0c107ae23366af34d4541d87eaed4de93b898147cd5bf68f7ded073a53500c4167a8971a2c26226d8f74d09eff1134a798bc882292c66884393feb18c1ceb989

Download Submit
memory/908-62-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/908-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/908-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x00000000002D0000-0x000000000032B000-memory.dmp

Filesize
364KB

Download
memory/1612-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1612-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download