9d58b6f6afb9a8237df181b9d0e1a250d122acd5d36208a3d2d7368bb9d25984

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
Size

37KB
MD5

9e631a5fa5204abd46257da5000926e8
SHA1

8ac06686f7e9a9c998aa6819d589e8eee181db7e
SHA256

9d58b6f6afb9a8237df181b9d0e1a250d122acd5d36208a3d2d7368bb9d25984
SHA512

511e13d446bfeca84ab00cac6fffbc85b8ca86e33f94d13d018be7a3ef35632431530befa0add265a400dd27be6784eb00910c368a8e3fa756771588a697961f
SSDEEP

768:9aVg5P5X/bWWDAYsAYaWBjZViqCp09VCBJiffi/30NZXggoX:9a+1KG3s3aCjZViHp0zgJifK3CZwFX

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
Token: SeDebugPrivilege	832	jsc.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1700	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	26
PID 1988 wrote to memory of 1700	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	26
PID 1988 wrote to memory of 1700	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	26
PID 1988 wrote to memory of 1188	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	27
PID 1988 wrote to memory of 1188	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	27
PID 1988 wrote to memory of 1188	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	27
PID 1988 wrote to memory of 1528	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	28
PID 1988 wrote to memory of 1528	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	28
PID 1988 wrote to memory of 1528	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	28
PID 1988 wrote to memory of 1532	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	29
PID 1988 wrote to memory of 1532	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	29
PID 1988 wrote to memory of 1532	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	29
PID 1988 wrote to memory of 1232	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	30
PID 1988 wrote to memory of 1232	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	30
PID 1988 wrote to memory of 1232	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	30
PID 1988 wrote to memory of 1200	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	31
PID 1988 wrote to memory of 1200	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	31
PID 1988 wrote to memory of 1200	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	31
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32
PID 1988 wrote to memory of 832	1988	8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe	32

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe
"C:\Users\Admin\AppData\Local\Temp\8ac06686f7e9a9c998aa6819d589e8eee181db7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:1188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/832-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/832-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/832-62-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1988-54-0x0000000000040000-0x000000000004E000-memory.dmp

Filesize
56KB

Download
memory/1988-55-0x0000000000530000-0x00000000005A0000-memory.dmp

Filesize
448KB

Download