Resubmissions
15-10-2023 11:37
231015-nrgycaha22 1024-07-2023 15:22
230724-ssamwaeh63 1024-07-2023 14:56
230724-sa2zeaee77 1024-07-2023 14:55
230724-sajg3aee68 1024-07-2023 14:49
230724-r64bnsed95 1013-03-2023 12:39
230313-pvx96scd7x 10Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2023 14:49
Behavioral task
behavioral1
Sample
jsFhhfngkaDj.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
jsFhhfngkaDj.exe
Resource
win10v2004-20230703-en
General
-
Target
jsFhhfngkaDj.exe
-
Size
936KB
-
MD5
8bd774fbc6f846992abda69ddabc3fb7
-
SHA1
a6e940b1bd92864b742fbd5ed9b2ef763d788ea7
-
SHA256
a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795
-
SHA512
037c1f895d3bb44e5f37abec7202325639d6414cab71df88663b573a04a5f8d9cd3f5939fdcfdec995cec35f6e3ed2f905b78270522ffdd98f7e2a93106d6480
-
SSDEEP
24576:zw71/dET5/y1ufQfvDN3y60HyOci+MIjxnGxs:Q1FWq1ufwrVy60HWMIVGK
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jsFhhfngkaDj.exepid process 2396 jsFhhfngkaDj.exe 2396 jsFhhfngkaDj.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 1376 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jsFhhfngkaDj.exeC:\Users\Admin\AppData\Local\Temp\jsFhhfngkaDj.exe runrun1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5ae8c24f052cabbabc36354b0278aab85
SHA11469a6649b2432a8dfd24b30c6bb0ab039cb092a
SHA256ff3ff10d2aa213d6f996ffe7b2daa3b17a3d93049dcb80f5aabd0c028ecf3f00
SHA512fec42d985413bd891e8b009e0666aadfd3ef395280cead0de6e56120f79ab112c043240321ae122c5018b00fcbf76af5c96b2c50047baf88b10fca1478ea6e1d