ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264.exe
Size

388KB
MD5

acc4d83f0e51c910107a156f9b9130dd
SHA1

7ae738c655f55f9c302f02dae4d7313f73b1d585
SHA256

ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264
SHA512

187925c87672a271b77c28f1feec5eab86f7d91e13d64a875e12fc51af437ac0eab99fb37f0e63ce62b64ade00e597eb763972ac5feb216a25794c90cb7f7474
SSDEEP

6144:GLiuv8j7ZuA5ErOOze1QXh0jfLwhkLX3fgZXVK7iRyM1KTlbfLWqqZy8JqMxLUO:wi1x55UIEhlCXvkXVg8IBjLvl8NLUO

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4016	wjkphye.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\wjkphye.exe	ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264.exe
File created	C:\PROGRA~3\Mozilla\cqrorok.dll	wjkphye.exe

C:\Users\Admin\AppData\Local\Temp\ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264.exe
"C:\Users\Admin\AppData\Local\Temp\ded062f160bdfd6cd9ef49c80e6f5460314a68753add70a055f24985960b0264.exe"
1⤵
- Drops file in Program Files directory
PID:4040

C:\PROGRA~3\Mozilla\wjkphye.exe
C:\PROGRA~3\Mozilla\wjkphye.exe -srbnrsa
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\wjkphye.exe

Filesize
388KB

MD5
8286bd97ad619f595a73c663487b7562

SHA1
3e51d38741250a0e0356a69081afbf6911fb2b4b

SHA256
6582169c184a8883456ec0592ea445a43cd30038b5d4692c587f4e7c6bb60063

SHA512
decf244048f5bbda8fcc346a61daf5f60dc21c123497c928c66c7e2069109d5bfdc15299d105bd12d1d0c9b49b02c7698912f5ee7f2cba60c7d805f13627731d

Download Submit
memory/4016-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4016-11-0x0000000000C70000-0x0000000000CCB000-memory.dmp

Filesize
364KB

Download
memory/4016-17-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4040-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4040-2-0x00000000021B0000-0x000000000220B000-memory.dmp

Filesize
364KB

Download
memory/4040-10-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download