c7108d5661247272e1852a63c2fb475386209b542c9148ceaa574ca62fb3c9d3

Analysis

max time kernel
140s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FileJet_0.8.2.2.exe
Size

2.6MB
MD5

a7f803870ba7c2a8a6f1fa9d3c9fdd95
SHA1

61e7a9d17cc90ceeb7d2d1f71c889a25061d1038
SHA256

c7108d5661247272e1852a63c2fb475386209b542c9148ceaa574ca62fb3c9d3
SHA512

d48321a0a8318c280f4c727fee4403352b117cb93f3434bcbaa5d925f186541a07275142fbab62b1443ebf1d423b85dc95a94699a55569019a1696d9fbd1892f
SSDEEP

49152:tBuZrEUldF74zJw7gWEFr3l3ISYL7q55DdN7POGjF:7kLSJg0l3oL7q55ljF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2832	FileJet_0.8.2.2.tmp

Loads dropped DLL 1 IoCs

pid	Process
2616	FileJet_0.8.2.2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileJet_0.8.2.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileJet_0.8.2.2.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29
PID 2616 wrote to memory of 2832	2616	FileJet_0.8.2.2.exe	29

C:\Users\Admin\AppData\Local\Temp\FileJet_0.8.2.2.exe
"C:\Users\Admin\AppData\Local\Temp\FileJet_0.8.2.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\is-HKB1U.tmp\FileJet_0.8.2.2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HKB1U.tmp\FileJet_0.8.2.2.tmp" /SL5="$400E6,1924407,832512,C:\Users\Admin\AppData\Local\Temp\FileJet_0.8.2.2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-HKB1U.tmp\FileJet_0.8.2.2.tmp

Filesize
3.0MB

MD5
9c046f466416f00590a89a84a4a40d19

SHA1
725ea66fee6fbc9add4e0ea0f933618395174ba2

SHA256
02a14265fc8f0154780110d1a83218a0ce3bdafe53a688c5a3662f4b86f51912

SHA512
58315f1592ae0c077ef8e163a559dcd71bb1b0893a7f2de9cbc7287d917f655c1596138a96c8abf28fc4d71a967c335091a280158a367c89b1b377ee94fc4b8c

Download Submit
memory/2616-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2616-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2616-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2832-8-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2832-12-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download