c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208.exe
Size

377KB
MD5

abf5120441a8f4c0b7fe9c9adeb3da2b
SHA1

e7c1eeb37461605f709e4455a5793d3511e49117
SHA256

c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208
SHA512

473cc9dfa97403b92df2ced9bcac8f35ca8e72fb37c0c1575dd8b1ca8a45dcd9fd28e46dac44e081c0279b543ca974c033f103bfdbd11db783bbe71b01abd3eb
SSDEEP

6144:G72k0YujF59B+SNiT1SRws339pnPJ7ImcvKoSYxTz:0FxujX9B+lAb9ImhoSmTz

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x000000000045F000-memory.dmp	UPX
behavioral1/files/0x000c0000000133d3-5.dat	UPX

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2052	iajbwsg.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/files/0x000c0000000133d3-5.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\iajbwsg.exe	c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208.exe
File created	C:\PROGRA~3\Mozilla\rnnqqck.dll	iajbwsg.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2172	c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208.exe
2052	iajbwsg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2052	2160	taskeng.exe	29
PID 2160 wrote to memory of 2052	2160	taskeng.exe	29
PID 2160 wrote to memory of 2052	2160	taskeng.exe	29
PID 2160 wrote to memory of 2052	2160	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208.exe
"C:\Users\Admin\AppData\Local\Temp\c1e2592f994c7460003c6503b5aacad0158fc1136273203128e444123fade208.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2172

C:\Windows\system32\taskeng.exe
taskeng.exe {FE693762-F947-4C7C-961E-81FB5B53211F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\PROGRA~3\Mozilla\iajbwsg.exe
  C:\PROGRA~3\Mozilla\iajbwsg.exe -zqrqjuc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\iajbwsg.exe

Filesize
377KB

MD5
520296578c965815f45b0b542b513004

SHA1
063b1564a628a3dacf646c48cd0929e75a753dc1

SHA256
4d95cb8118d7e344e628500a3bfef05bc80c9e03d52046ee7b9c65bfc3aa9642

SHA512
b416ec2a6df0f16743802d5dfe8e0e8c3b378a61b4b3b72f58eca66861a0d8b7f1e0a5e9c9980cd239d5afa1c44390b6cd5fe973b8b44dd96c96baf5a7167820

Download Submit
memory/2052-7-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/2052-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2052-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2172-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2172-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2172-1-0x0000000000260000-0x00000000002BB000-memory.dmp

Filesize
364KB

Download
memory/2172-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download