ff7706dad388652ba868408d8848872f1a19d0e6f1a730c31c88572af5faa8bf | Triage

Analysis

max time kernel
514s
max time network
517s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 09:47

Sharing

Report Analysis Logs

General

Target

jose-jwt.dll
Size

81KB
MD5

3932710fd1cfc829efaee90f08e74208
SHA1

105d65bfbc12e8e9c27d6dde9484bc85e7a7f77e
SHA256

a02b713b6a99cb0b3f85e9f389275bf904eee8be848b2a8c41507c64b264133a
SHA512

0ecb5a5b1ab5308f6c48428e244639f8d5f9a4514f9822a92f29798b1b3e7a0d60922c93543e637abd22613643feeb18cc17cdc9e906a06bc649971e678c0715
SSDEEP

1536:OglH/sWHgmHzzCr51o+ZpKEusq5RIH+qh7D259P5h3+F1AAy/Dc:OgyN1nK86Q7D2jPn3+F1AAyg

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1FAFF5AC-F681-4ED9-8BF7-4BE8437757F8}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7F5BC29B-BE54-4917-A56A-EEA8E1D62DF7}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{78D1E9A3-AFF7-4C69-A618-C4B8FF0004FD}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{091E84D9-A851-431A-A3AD-9D61AAF9CD45}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AC327F47-1AD2-4696-8594-20EFE3E04BDD}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{CD8EAC29-1B78-4207-8E38-906845CF4D44}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{18F1FDBB-FDE8-47C6-89F2-BD672B7514E3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AFF0D61A-03D0-4C4A-B23C-01EF26825F01}.catalogItem	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jose-jwt.dll,#1
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads