0a3db60f639f65ee7be02baa180b554d999920ba5c3bb89108f90da003c35b68

Analysis

max time kernel
150s
max time network
52s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ojujn.exe
Size 776KB
Sample260824-xta29asdnb
SHA256 0a3db60f639f65ee7be02baa180b554d999920ba5c3bb89108f90da003c35b68
MD5 8585e2ae12eed5b2ee53c25f1e3277a2
SHA1 59e01b15eae0345bbfaeb90c73adfc889ca5e1ef
SHA512 ce5c813da3cbc93084a66e128d3704f252e2b060ec9b401a510899a2ae6690d6db7f131d3695d6cdab6727879b1f673fd64b86cc2f9515a189ebde3d0134e6d6
SSDEEP 12288:IngwZs/X8eipbJVfMxBkfCTE+HCTQzkyxBlDetAqxSvoD:IgwaMeipbfCkKTEGmQYyb+
TLSH
T171058C1AF3A502F9D07BC178C9424552EB72B8565330AADF03E14A6A1F376E05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ojujn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ojujn.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	ojujn.exe
4888	ojujn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1640	4888	ojujn.exe	89
PID 4888 wrote to memory of 1640	4888	ojujn.exe	89
PID 4888 wrote to memory of 5028	4888	ojujn.exe	92
PID 4888 wrote to memory of 5028	4888	ojujn.exe	92
PID 4888 wrote to memory of 356	4888	ojujn.exe	95
PID 4888 wrote to memory of 356	4888	ojujn.exe	95
PID 4888 wrote to memory of 5132	4888	ojujn.exe	98
PID 4888 wrote to memory of 5132	4888	ojujn.exe	98

C:\Users\Admin\AppData\Local\Temp\ojujn.exe
"C:\Users\Admin\AppData\Local\Temp\ojujn.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

76504D54-594B-21E8-A7DC-2330BFE47BF8.txt

Path C:\ProgramData\76504D54-594B-21E8-A7DC-2330BFE47BF8.txt
Size 64B
SHA256 55364c21493783948e263d5191b0f2e54cd322a24d3f7017381e271b685ee034
MD5 1a98a8ac3b6642b6c51355f708dce083
SHA1 87ba19efa6cbed8077d8da7b8dc1f162b1a78856
SHA512 d6e565253c5a3b3efaec15e43d33c6fb063419baa35c229c3cb26e996b9a4007a72df7454a82a09133f062d245a3c8cda7420a4ca51be869d323fab1f3f8bf38
TLSH
T1C1A002563934F9FE57A73512D3522867521E84500E46930A538A9460194AF3A6212664
MD5 SHA1 SHA512 TLSH

Submit Download