Analysis
-
max time kernel
99s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 23:53
Static task
static1
Behavioral task
behavioral1
Sample
038159.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
038159.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/jaqxzro.dll
Resource
win7-20240221-en
General
-
Target
038159.exe
-
Size
251KB
-
MD5
f89aeda946171325b3cc41db4e0c7356
-
SHA1
83da10df168a7801bef8257fcbdc23bf18f0d15c
-
SHA256
5beadd0ecc9f1407dab89746630fddf7362dd00323e6a5e5413a0c286e2ee583
-
SHA512
229332eb6bec4208a2eb9055237ee5ac83a9da577ce04f2a0a9bad2c6c113b815ff60876d265f344d10d36d20da3bb4444ef2c8896fe9dc6005bac73a3c902ab
-
SSDEEP
6144:wBlL/cYzuovWn9oMSJgRXlD9LhVLwsLXUMn3ua/TY:Cecuo+yMSYlebMn3ua/TY
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
038159.exepid process 4144 038159.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2004 4144 WerFault.exe 038159.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
038159.exedescription pid process target process PID 4144 wrote to memory of 4336 4144 038159.exe 038159.exe PID 4144 wrote to memory of 4336 4144 038159.exe 038159.exe PID 4144 wrote to memory of 4336 4144 038159.exe 038159.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\038159.exe"C:\Users\Admin\AppData\Local\Temp\038159.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\038159.exe"C:\Users\Admin\AppData\Local\Temp\038159.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4144 -ip 41441⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsy339F.tmp\jaqxzro.dllFilesize
29KB
MD51e8aa5fcc0f7de7a0836081dd9efff05
SHA148317ef5f587f52fd34b42164dfb893dcde95e1b
SHA2565389af7b3d0f5a3496cd2aa538a6ee01fd5a9bd1a8fcf3b9411f4112313d43af
SHA512addd27d8923bf5d3f7d87e3eb2f6138d05532aa7c9340fde2f998a84fa87f227b63cd515176940de099d4f8dc46d1ab7467f4e347e266d0ef128d7337d79ea16
-
memory/4144-6-0x00000000750B0000-0x00000000750BB000-memory.dmpFilesize
44KB
-
memory/4144-9-0x00000000750B0000-0x00000000750BB000-memory.dmpFilesize
44KB