Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 14:16
Static task
static1
Behavioral task
behavioral1
Sample
df5ddf1d942961d1b28ae405d350049f.exe
Resource
win7-20240220-en
General
-
Target
df5ddf1d942961d1b28ae405d350049f.exe
-
Size
30KB
-
MD5
df5ddf1d942961d1b28ae405d350049f
-
SHA1
b1c283eebb15433251cd76e19b9079bdcd458c5b
-
SHA256
d99de53a9cd546ffcfbe0d3a668ba79abc6ff38c2b2b9bd596b98a0565f6d27f
-
SHA512
ddcc377b33d88bd9ce501b1bde6b7a800663bf6cfac21569c5e7203e86e2f2233ec0508e0f96778c0a24e210ce4e289fdf3e79caace4401b56798c9ab8796a4d
-
SSDEEP
768:Dd9FZLvaC1IeCvFinHuMocJnZPZU21skdbuVcDv:xZuSIWu8JnZPZvbuV
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 24 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html -
Drops file in System32 directory 1 IoCs
Processes:
df5ddf1d942961d1b28ae405d350049f.exedescription ioc process File created C:\Windows\SysWOW64\csrs.scr df5ddf1d942961d1b28ae405d350049f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df5ddf1d942961d1b28ae405d350049f.exe"C:\Users\Admin\AppData\Local\Temp\df5ddf1d942961d1b28ae405d350049f.exe"1⤵
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\csrs.scrFilesize
413KB
MD55218c47a10ad51e03752fb3832813c6c
SHA124750a72eee3630fac908626f91cb033a48f5c4c
SHA256d76414674b6e5639cd543f422d03a3c59adfd049462f9107a7fa00730d2520e7
SHA5126e19c711608d229cf99e128cf8cfced73055d59780a7439432ce2fe43055090cf34e40658e9baccbdf572164fd2f3631b7e226c3294f030af46cfc640d0fa030
-
memory/5036-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5036-1-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/5036-11-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5036-13-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB