e4f74dc6136f4d286f22846de7a501b27e15c15fbba9abe9263e42ac4bafa14d | Triage

Analysis

max time kernel
17s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
16-08-2021 14:33

Sharing

Report Analysis Logs

General

Target

Jonic free .exe
Size

7.8MB
MD5

4fd63e0d9cea42ab1b05a711e378c110
SHA1

b768f2b73693c53142b2d98ca2d7ced5ed33c0aa
SHA256

e4f74dc6136f4d286f22846de7a501b27e15c15fbba9abe9263e42ac4bafa14d
SHA512

557b8f4c17b75e1c9b607e3895264b257639ff39dbd3c235428aa4bd9f0c0a405f61b3824cd3bbccc51e03399b854e1f4e3f4ddbfd7b35317b844c67662e9fb3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 808 WerFault.exe javaw.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1664 WerFault.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Jonic free .exe

description	pid	process	target process
PID 3908 wrote to memory of 808	3908	Jonic free .exe	javaw.exe
PID 3908 wrote to memory of 808	3908	Jonic free .exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\Jonic free .exe
"C:\Users\Admin\AppData\Local\Temp\Jonic free .exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\Jonic free .exe" org.develnext.jphp.ext.javafx.FXLauncher
2⤵
PID:808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 808 -s 356
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x0000000000000000-mapping.dmp

Download