Analysis
- max time kernel
139s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
02/04/2023, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
qZGYOyA5rG.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
- Target qZGYOyA5rG.exe
- Size 130KB
- Sample230402-arlpmsdf57
- SHA256 bdf296434f9ad3d332b00073d74a884ca78b7a6a535f1e1b63f510d9e77dc3c1
- MD5 78f7ba13edd008ea22a8116e6a3b56ba
- SHA1 e2fc9ef2ec44db2e01eeec52ded29ed0b24fa10f
- SHA512 9af521e0ec23a902204f7effe3801f5b20e959e1d95c4e76d394087388953205aa5accd706ff6022c5e0ff11b6e728801f4847900864ee74ddea79cedf2c58c8
- SSDEEP 3072:zewcPHgx8H/yC1wR9m4wHfKIu/970vZX6K:qwcKl9m/K//mvVn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3252 tjpxgd.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\corolina17.job qZGYOyA5rG.exe - Program crash 2 IoCs
pid pid_target Process procid_target 4020 2176 WerFault.exe 85 1700 3252 WerFault.exe 94 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe - Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe 2176 qZGYOyA5rG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qZGYOyA5rG.exe"C:\Users\Admin\AppData\Local\Temp\qZGYOyA5rG.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
PID:2176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 9522⤵
- Program crash
PID:4020
-
-
C:\ProgramData\coejiij\tjpxgd.exeC:\ProgramData\coejiij\tjpxgd.exe start21⤵
- Executes dropped EXE
PID:3252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 4682⤵
- Program crash
PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2176 -ip 21761⤵PID:920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3252 -ip 32521⤵PID:3200
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\coejiij\tjpxgd.exe
- Size 130KB
- SHA256 bdf296434f9ad3d332b00073d74a884ca78b7a6a535f1e1b63f510d9e77dc3c1
- MD5 78f7ba13edd008ea22a8116e6a3b56ba
- SHA1 e2fc9ef2ec44db2e01eeec52ded29ed0b24fa10f
- SHA512 9af521e0ec23a902204f7effe3801f5b20e959e1d95c4e76d394087388953205aa5accd706ff6022c5e0ff11b6e728801f4847900864ee74ddea79cedf2c58c8
- SSDEEP 3072:zewcPHgx8H/yC1wR9m4wHfKIu/970vZX6K:qwcKl9m/K//mvVn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\coejiij\tjpxgd.exe
- Size 130KB
- SHA256 bdf296434f9ad3d332b00073d74a884ca78b7a6a535f1e1b63f510d9e77dc3c1
- MD5 78f7ba13edd008ea22a8116e6a3b56ba
- SHA1 e2fc9ef2ec44db2e01eeec52ded29ed0b24fa10f
- SHA512 9af521e0ec23a902204f7effe3801f5b20e959e1d95c4e76d394087388953205aa5accd706ff6022c5e0ff11b6e728801f4847900864ee74ddea79cedf2c58c8
- SSDEEP 3072:zewcPHgx8H/yC1wR9m4wHfKIu/970vZX6K:qwcKl9m/K//mvVn
- MD5 SHA1 SHA512 SSDEEP