Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 00:59
Static task
static1
Behavioral task
behavioral1
Sample
d784ccf577e5a46ce311a3c23f15761f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d784ccf577e5a46ce311a3c23f15761f.exe
Resource
win10v2004-20240226-en
General
-
Target
d784ccf577e5a46ce311a3c23f15761f.exe
-
Size
11.4MB
-
MD5
d784ccf577e5a46ce311a3c23f15761f
-
SHA1
6093a2d76d32d6515499f1e85f085360beddca31
-
SHA256
68af833277016e0badafa620d8e44fe924a0d286fc9c44771f41023f9d1defd7
-
SHA512
a5c21cd3289ba7c216c8b77288cd6b29755f1d7dc755d6216a63727e92f03d65fe578f05307981c9c6914768951d02461cb7f330b76c7a7e9a6cb2b44c7c9d80
-
SSDEEP
49152:EQFRHrmQG+yrY+Fr/rcrvrDRHrmQG+yrY+Fr/rcrMrMrgrcrvrDRHrmQG+yrY+FM:EcKUKEKsyEp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2616 rjqx.exe -
Loads dropped DLL 2 IoCs
pid Process 2240 d784ccf577e5a46ce311a3c23f15761f.exe 2240 d784ccf577e5a46ce311a3c23f15761f.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main rjqx.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2616 rjqx.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2616 rjqx.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2616 rjqx.exe 2616 rjqx.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2616 2240 d784ccf577e5a46ce311a3c23f15761f.exe 28 PID 2240 wrote to memory of 2616 2240 d784ccf577e5a46ce311a3c23f15761f.exe 28 PID 2240 wrote to memory of 2616 2240 d784ccf577e5a46ce311a3c23f15761f.exe 28 PID 2240 wrote to memory of 2616 2240 d784ccf577e5a46ce311a3c23f15761f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d784ccf577e5a46ce311a3c23f15761f.exe"C:\Users\Admin\AppData\Local\Temp\d784ccf577e5a46ce311a3c23f15761f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\rjqx.exeC:\Users\Admin\AppData\Local\Temp\rjqx.exe -run C:\Users\Admin\AppData\Local\Temp\d784ccf577e5a46ce311a3c23f15761f.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD523d7e48b58ddbef0cf5788717c41d97d
SHA1121844de451ef605de8da6eec26e280155486f5f
SHA256049f4acc0ebdc611d2c6855af5a4eac3a32e1cc33da7b34060fd91e4023c8843
SHA512d5822ba6441af2aa0107bda45f27afddceea0b150c6650068a8b2610b3913feac48ba03082a246489b6552d2e0c703904f1857282763989d5e63b94bc97f326a
-
Filesize
6.5MB
MD54e2598567c3259b6abfdacdd89ceef9c
SHA1d3833610f8502938819311dd9a4c00d3240e9f31
SHA256cbb3e88248a5fe7c8f601df488c76f5085ba957ec802b09b4d7de085a62e04dd
SHA51241ffcd9c6e68665fe8b7626c44b374460972d7681bf1ed4d955de8c04e899b0c5976cf5a0241e7c2ba8692613b5eb5f9b618eacbcc39f3b126f65daf69ba90ed
-
Filesize
7.6MB
MD5fa6db9d3d69f4051448bd060f15f05c7
SHA175c5c5c9553c4177239e3a7b3b956c3340076547
SHA25628e2a89dd808a917cbfaa99968de60d36500c8e2e101f2aeb4d9ab281dcf0125
SHA512efe6ade482f897ce1ab485e99c3c8244dd22de5c06701731cf1908ccd54c3226f14bbb320f0db8f81940cb5f99e4811aa57499385e8c9e7312a084c12e0db464
-
Filesize
9.7MB
MD52cd7f83244a27ef6f66e536e29377c51
SHA18119b67cf153f5f56ad8fe0fedcdc0c2545021aa
SHA2562ead4bc570521bf37257ceb56449d25ca96389c912634ec52c7239a5b60c69c9
SHA51275635a43a690871567f105c7f07db760f65d3da7d37d792f15f62c388a5d864d40ccbd2ae922a58414fa9c33d2c859325be4261bb501e5fa661306c2c0ae7b12
-
Filesize
8.4MB
MD57132caee3021e364304eda096785d2aa
SHA1856eb913a034a75263793b7121824d692a5aebfd
SHA256f9f90974f474be42d4d117c60fcf6c2ad73fcd5ba41a0f0ba29448c8b524a3b9
SHA51223ff83c47316181cdcdb7de8bb3c503d2c308a0e0e3a5aa60c4ee641e06449d3a5024f0d3d2486cdbd5c93da6aa573bb5e87a114314ae9709ab93badf7da86cb