Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-07-2023 18:08

General

  • Target

    c414e1fc94973dex_JC.exe

  • Size

    1.8MB

  • MD5

    c414e1fc94973d951c0cf408bc59ab2b

  • SHA1

    db78ba12de3b39426f2e9d7fb72a3e2e4b4bd59d

  • SHA256

    bbefaf28f1afc56ea9053fdf00d08d3879a48539bf1089207d19c600a20a7125

  • SHA512

    69b9239a521a198e4047c137e5bdfcd05a86922735937cfdf430da53d52a61d465aa8852d372c2a7f1db77e316050e04198cfe114a92c4be2c5ee46d820fdb7d

  • SSDEEP

    24576:IBgfFUqV89IQ48LVZyRx5zzbCDOnkkoqbWadw4BagBzU+lGB3kOOeSWosqj2fY72:I3Tnkob+lnOOexaXV8

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c414e1fc94973dex_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\c414e1fc94973dex_JC.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:4352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 576
      2⤵
      • Program crash
      PID:2360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4352 -ip 4352
    1⤵
      PID:2152

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4352-133-0x00000000024F0000-0x0000000002618000-memory.dmp

      Filesize

      1.2MB

    • memory/4352-135-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB

    • memory/4352-136-0x00000000024F0000-0x0000000002618000-memory.dmp

      Filesize

      1.2MB

    • memory/4352-137-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB