9645af60ba2054b47963539d08d5d3d28f447cc0769fd89ba792b5cf2ea10f9f | Triage

Resubmissions

10/01/2023, 18:56

230110-xlfmrsch5y 1

10/01/2023, 18:54

230110-xka1wsch4t 7

10/01/2023, 18:53

230110-xjnklaha96 1

Analysis

max time kernel
74s
max time network
65s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 18:54

Sharing

Report Analysis Logs

General

Target

PCBioUnlock.jar
Size

14.3MB
MD5

2c7d7e84e1026c5611f19bb4a673fbd6
SHA1

e9946b416f1e85a2790c859f9d3946f224e171b8
SHA256

9645af60ba2054b47963539d08d5d3d28f447cc0769fd89ba792b5cf2ea10f9f
SHA512

e7b50ecf83389c3af0f706011d8bb37fa4fd94dbae3adc9e457b0984a25ece4e48e3851d6f7bf06e95b78d1dc71d40668c3f35d1fee62cc7e29a917df9f27213
SSDEEP

393216:KUgjTI1Jp0ipw+v+iupvTdSKHZFV4e9OyN8x:KUDbAo+iu5DV4TyNy

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1752	AUDIODG.EXE
Token: 33	1752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1752	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1508	AcroRd32.exe
1508	AcroRd32.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PCBioUnlock.jar
1⤵
PID:1080

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\UnblockDebug.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1080-64-0x0000000002260000-0x0000000005260000-memory.dmp

Filesize
48.0MB

Download
memory/1508-67-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download