Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
21/04/2023, 04:34
General
-
Target
jr046465.exe
-
Size
474KB
-
MD5
0515c9e2ce63669e851f99d3b1104a5d
-
SHA1
cd240e71b254e635c5aa9a410094796742d26f5e
-
SHA256
41366e86dccf6c95876cb9d793923275e33b3223ee03d0bfbc34b1bf748afc10
-
SHA512
5c98bc3f6f8b353904f9ccae42418c0361cec7a25027b6608a3378b87b7b7f7a18cd2fd7dde74a51dc0a99ef2b5fb97a8ec19a91efc81bdd0e7f8df028d83ddb
-
SSDEEP
6144:siESzl1QpPyTqW1JvsI45ExO+GFm+JbTQJiWIzDRHwjoI/RHEQj9TKO8RZ:soZapIqKxsIw+OzNtQjoI5HZTKO8v
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jr046465.exe"C:\Users\Admin\AppData\Local\Temp\jr046465.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB