3ad8f84317864374f712239160d20dfdbe7344258a52c4cd2f6e2c1d021882a3

Analysis

max time kernel
17s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00efe2753a566b642d4a60fc1ba9287f.exe
Size

96KB
MD5

00efe2753a566b642d4a60fc1ba9287f
SHA1

cbe78e2c2cff98ceb418eafd7a18b65291e3d5e2
SHA256

3ad8f84317864374f712239160d20dfdbe7344258a52c4cd2f6e2c1d021882a3
SHA512

06012f1444ffc9bc45462915a99aa4c01323e01a0944ac052a7d6863c876fb7ddbeae67db20f663fa9953df53498b729fb36d9d22022b58a8c05a2ce94c9aa55
SSDEEP

1536:aRlLjoTApUl4NcE+aJu0AfSEnE3RDKbOccyF4VemCvR:aTLJ6l4Nb+4ASFRDKbRJF4VbQ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3648	Dmjnjq.exe
4900	Dmjnjq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dmjnjq = "C:\\Users\\Admin\\AppData\\Roaming\\Dmjnjq.exe"	00efe2753a566b642d4a60fc1ba9287f.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 3648 set thread context of 4900	3648	Dmjnjq.exe	84

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	00efe2753a566b642d4a60fc1ba9287f.exe
876	00efe2753a566b642d4a60fc1ba9287f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	Dmjnjq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
780	IEXPLORE.EXE
780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 2408 wrote to memory of 876	2408	00efe2753a566b642d4a60fc1ba9287f.exe	21
PID 876 wrote to memory of 3648	876	00efe2753a566b642d4a60fc1ba9287f.exe	83
PID 876 wrote to memory of 3648	876	00efe2753a566b642d4a60fc1ba9287f.exe	83
PID 876 wrote to memory of 3648	876	00efe2753a566b642d4a60fc1ba9287f.exe	83
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 3648 wrote to memory of 4900	3648	Dmjnjq.exe	84
PID 4900 wrote to memory of 1604	4900	Dmjnjq.exe	100
PID 4900 wrote to memory of 1604	4900	Dmjnjq.exe	100
PID 4900 wrote to memory of 1604	4900	Dmjnjq.exe	100
PID 1604 wrote to memory of 780	1604	iexplore.exe	101
PID 1604 wrote to memory of 780	1604	iexplore.exe	101
PID 780 wrote to memory of 1364	780	IEXPLORE.EXE	102
PID 780 wrote to memory of 1364	780	IEXPLORE.EXE	102
PID 780 wrote to memory of 1364	780	IEXPLORE.EXE	102

C:\Users\Admin\AppData\Local\Temp\00efe2753a566b642d4a60fc1ba9287f.exe
"C:\Users\Admin\AppData\Local\Temp\00efe2753a566b642d4a60fc1ba9287f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\00efe2753a566b642d4a60fc1ba9287f.exe
  䌢尺獕牥屳摁業屮灁䑰瑡屡潌慣屬敔灭ぜ攰敦㜲㌵㕡㘶㙢㈴㑤㙡昰ㅣ慢㈹㜸⹦硥≥
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Users\Admin\AppData\Roaming\Dmjnjq.exe
    "C:\Users\Admin\AppData\Roaming\Dmjnjq.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Users\Admin\AppData\Roaming\Dmjnjq.exe
      䌢尺獕牥屳摁業屮灁䑰瑡屡潒浡湩屧浄湪煪攮數"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:17410 /prefetch:2
        7⤵
        
        PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Dmjnjq.exe

Filesize
96KB

MD5
00efe2753a566b642d4a60fc1ba9287f

SHA1
cbe78e2c2cff98ceb418eafd7a18b65291e3d5e2

SHA256
3ad8f84317864374f712239160d20dfdbe7344258a52c4cd2f6e2c1d021882a3

SHA512
06012f1444ffc9bc45462915a99aa4c01323e01a0944ac052a7d6863c876fb7ddbeae67db20f663fa9953df53498b729fb36d9d22022b58a8c05a2ce94c9aa55

Download Submit
C:\Users\Admin\AppData\Roaming\Dmjnjq.exe

Filesize
43KB

MD5
2a3bb03af0fc3f5b22e4eb2347bf4b54

SHA1
4ac3974f75e2d25720c156b6626c31028a674463

SHA256
061d04cc97ef9d31e685cce7c21fa46d3ed8453b026ec7c3c21dee9923a9c94b

SHA512
777860f20dbcca149a87d04f3ef760bcdc22be0c2d410949cf9e86511dd5ad7903fdded15d82f7f10c4a7b4f1c720be6cf0926f20740b5441d703173d883cbcf

Download Submit
C:\Users\Admin\AppData\Roaming\Dmjnjq.exe

Filesize
76KB

MD5
58a6d90c4b4f472106e0149b7b874f0e

SHA1
fb5e85f54440003cf18cf8fb3ead2636585cfdd7

SHA256
66e17db3d19216f09dd6b146e669c097cd8983e3a8bc94f4f5f6a73134fb4d8e

SHA512
9b25f35a531449b48848ed85a3935a5f5db7057b980160fb616f12dbf1c9df4abbaa2daea7e2799703664f8db63ee71199f6573734144f246baa2d4ffc7787d6

Download Submit
memory/876-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2408-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3648-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3648-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4900-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4900-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download