Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2023, 15:47

General

  • Target

    3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe

  • Size

    563KB

  • MD5

    a3a0f7c65d064edfcb7e72361aacc6ab

  • SHA1

    ce1635ae1b2e9efb91030ed135069513d226c262

  • SHA256

    3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009

  • SHA512

    9efd3fc52d4896247a2ba427bbcf156be6ab1ef68281d9af493a090d0ef01e2aa8d572d89028797fe3eeb99c5c367b1e69d0077039f471a69c36850c5195ad8a

  • SSDEEP

    6144:JEDeFkyh1E/65Q7nEbxFUPKpgr3UGwh1E/65Q7nEhe82wWMaYEYbxFUPKpgr3Ugs:WDeFSp0465c2Jc6Zeq91im6omxg

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
      2⤵
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Users\Admin\AppData\Local\Temp\3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009exe_JC.exe"
      2⤵
        PID:308
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 624
        2⤵
        • Program crash
        PID:2804

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2556-59-0x000000006F870000-0x000000006FE1B000-memory.dmp

            Filesize

            5.7MB

          • memory/2556-60-0x000000006F870000-0x000000006FE1B000-memory.dmp

            Filesize

            5.7MB

          • memory/2556-62-0x00000000022D0000-0x0000000002310000-memory.dmp

            Filesize

            256KB

          • memory/2556-64-0x000000006F870000-0x000000006FE1B000-memory.dmp

            Filesize

            5.7MB

          • memory/2652-53-0x00000000009E0000-0x0000000000A74000-memory.dmp

            Filesize

            592KB

          • memory/2652-54-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB

          • memory/2652-55-0x00000000004D0000-0x000000000050E000-memory.dmp

            Filesize

            248KB

          • memory/2652-56-0x00000000007D0000-0x0000000000810000-memory.dmp

            Filesize

            256KB

          • memory/2652-61-0x0000000000320000-0x000000000032A000-memory.dmp

            Filesize

            40KB

          • memory/2652-65-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB