cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4.exe
Size

276KB
MD5

28c6fbef2417d9e2cf58373001388e43
SHA1

98020a0e655d8596fe70c9f8b83b2f2adef88a7b
SHA256

cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4
SHA512

ece962ba6097607d8f76a20ba138550385bf7af1dc325dccb82125ece7e4f0a2a085976f091028d7cf4387b66a4511d891bc4b87b550e7ed3d2a82f27e00a9ea
SSDEEP

6144:yFpiTSfDhpOQAYg718kVFRCHplF6UoLGqpXwx:FTSfDh7AL18UwJbhWXwx

Score

9^/10

persistence

Malware Config

Signatures

Detects executables packed with ASPack 2 IoCs

resource	yara_rule
behavioral2/memory/3488-0-0x0000000000400000-0x0000000000469000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000002333b-4.dat	INDICATOR_EXE_Packed_ASPack

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2216	jhifwqk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jhifwqk.exe	cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4.exe
File created	C:\PROGRA~3\Mozilla\biclnte.dll	jhifwqk.exe

C:\Users\Admin\AppData\Local\Temp\cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4.exe
"C:\Users\Admin\AppData\Local\Temp\cd4da35f3c8a5239a5d174ddb7ff1711229383ae44eb8629267a7c4aed6e80f4.exe"
1⤵
- Drops file in Program Files directory
PID:3488

C:\PROGRA~3\Mozilla\jhifwqk.exe
C:\PROGRA~3\Mozilla\jhifwqk.exe -zmqutfb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:8
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\jhifwqk.exe

Filesize
276KB

MD5
7c272f2baf3b79da8eb2c70858c27548

SHA1
76c05f4dbb1eedbc82f5879dda4891f23c75c595

SHA256
b4dbdeb2f546d528f89f801bc2acfde558a515766bf94f11890f8cd96a28aca3

SHA512
f20f4b18d7d7d51e8da20180cc803181aa6a67b7c80e5045379713b1c5b87b124f8aff93502c5336b537a2a174f6803ecfed2f167b56e38bfbaee9b89b3bb60e

Download Submit
memory/2216-9-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Filesize
368KB

Download
memory/2216-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2216-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3488-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3488-1-0x0000000000760000-0x00000000007BC000-memory.dmp

Filesize
368KB

Download
memory/3488-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3488-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3488-8-0x0000000000760000-0x00000000007BC000-memory.dmp

Filesize
368KB

Download