Analysis
-
max time kernel
187s -
max time network
220s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-02-2022 07:40
General
-
Target
Jack Move.exe
-
Size
80.1MB
-
MD5
39794b681edd8dfa2c50ddae6d875585
-
SHA1
8823c542786d6b669946206cdcbd3d7de4698ae6
-
SHA256
53927686261b37088a9c8ca2e410526c4c2d3aa08414c653da0640a79ba128e8
-
SHA512
207b3e9f6a145dd477d96dbc4a8a74c441c3981bb922af37ebcfeb94b873145b783887a7920bbc9d60af0015fd5acf88266f76ddaea4716ffd771eb19cf5870c
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jack Move.exe"C:\Users\Admin\AppData\Local\Temp\Jack Move.exe"1⤵
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
56192831a7f808874207ba593f464415
SHA1e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA2566aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33
-
MD5
5a152897598d6ffc1912b124bf62f3b7
SHA1f32c1866c88f43782ca16e66abdc2337fbe0bc10
SHA2567a1f4c63eaae9853ddeb88ab3de9d5a36750e5e5e83c21f75bdff6c7c26ab7e8
SHA51243d4f65c2f8bd1764a04d0c85a9b42ade28947621e5506fd48b41c84cb68d1bcb151df344e63a2e76ea55406e7d5ae8f4c8b295b00a71b98068b5da0c25b935c
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB