d99de53a9cd546ffcfbe0d3a668ba79abc6ff38c2b2b9bd596b98a0565f6d27f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 14:16

Target

df5ddf1d942961d1b28ae405d350049f.exe
Size

30KB
MD5

df5ddf1d942961d1b28ae405d350049f
SHA1

b1c283eebb15433251cd76e19b9079bdcd458c5b
SHA256

d99de53a9cd546ffcfbe0d3a668ba79abc6ff38c2b2b9bd596b98a0565f6d27f
SHA512

ddcc377b33d88bd9ce501b1bde6b7a800663bf6cfac21569c5e7203e86e2f2233ec0508e0f96778c0a24e210ce4e289fdf3e79caace4401b56798c9ab8796a4d
SSDEEP

768:Dd9FZLvaC1IeCvFinHuMocJnZPZU21skdbuVcDv:xZuSIWu8JnZPZvbuV

Score

6^/10

motw phishing

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

24 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html
Drops file in System32 directory 1 IoCs

Processes:

df5ddf1d942961d1b28ae405d350049f.exe

description ioc process

File created C:\Windows\SysWOW64\csrs.scr df5ddf1d942961d1b28ae405d350049f.exe

flow	ioc
24	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

description	ioc	process
File created	C:\Windows\SysWOW64\csrs.scr	df5ddf1d942961d1b28ae405d350049f.exe

C:\Users\Admin\AppData\Local\Temp\df5ddf1d942961d1b28ae405d350049f.exe
"C:\Users\Admin\AppData\Local\Temp\df5ddf1d942961d1b28ae405d350049f.exe"
1⤵
- Drops file in System32 directory
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2468

C:\Windows\SysWOW64\csrs.scr
Filesize
413KB

MD5
5218c47a10ad51e03752fb3832813c6c

SHA1
24750a72eee3630fac908626f91cb033a48f5c4c

SHA256
d76414674b6e5639cd543f422d03a3c59adfd049462f9107a7fa00730d2520e7

SHA512
6e19c711608d229cf99e128cf8cfced73055d59780a7439432ce2fe43055090cf34e40658e9baccbdf572164fd2f3631b7e226c3294f030af46cfc640d0fa030

Download Submit
memory/5036-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5036-1-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/5036-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5036-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download