ba014ec4ead7332889e2fb12fcd7806183b254b3e32dd02c5bec81b73478d94a

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SetupPayServ2_JKOS.exe
Size

3.0MB
MD5

5145df523d499dbeefd1b8693a1ebd75
SHA1

7ac080250d25c9e8439d8e018efb5b5234d744ca
SHA256

ba014ec4ead7332889e2fb12fcd7806183b254b3e32dd02c5bec81b73478d94a
SHA512

dc8b2f2bb623fa2925212ca1b4481191d828ab9314ad3b11e0015ec8e2d956069456c5b195c14723f5d6bf297776dc4d7d119fddfbb19e1b67ca290512b3a33e
SSDEEP

98304:RGLmvHn5U3IAfn180Dy8QMDWHFWrT6uf0Jo:wmvHnYv180DsuWlWf6us6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2032	SetupPayServ2_JKOS.tmp

Loads dropped DLL 3 IoCs

pid	Process
2964	SetupPayServ2_JKOS.exe
2032	SetupPayServ2_JKOS.tmp
2032	SetupPayServ2_JKOS.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	SetupPayServ2_JKOS.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28
PID 2964 wrote to memory of 2032	2964	SetupPayServ2_JKOS.exe	28

C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe
"C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\is-5BR9P.tmp\SetupPayServ2_JKOS.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5BR9P.tmp\SetupPayServ2_JKOS.tmp" /SL5="$80124,2794108,119296,C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5BR9P.tmp\SetupPayServ2_JKOS.tmp

Filesize
1.1MB

MD5
6a96bef4679e16a54b4090e74664dcca

SHA1
c8631c1624b98f6709b1ac37ce3956faed29bc30

SHA256
cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783

SHA512
924ab1e5c6ea72342eab6e78899a56c415e90020c46d3d8a81ae4da9276db7ea1df9684965a81fb95a6f2f9cf103b31413d67770eb15725ad04198c5d00037d0

Download Submit
\Users\Admin\AppData\Local\Temp\is-5BR9P.tmp\SetupPayServ2_JKOS.tmp

Filesize
1.1MB

MD5
6a96bef4679e16a54b4090e74664dcca

SHA1
c8631c1624b98f6709b1ac37ce3956faed29bc30

SHA256
cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783

SHA512
924ab1e5c6ea72342eab6e78899a56c415e90020c46d3d8a81ae4da9276db7ea1df9684965a81fb95a6f2f9cf103b31413d67770eb15725ad04198c5d00037d0

Download Submit
\Users\Admin\AppData\Local\Temp\is-FC5SF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-FC5SF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2032-60-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2032-69-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2032-70-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2964-53-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2964-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads