7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2023 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
Size

3.5MB
MD5

8a470899a6ebb2299b54da55ad3897d2
SHA1

1ebafddb262fe912641e260fcf407907ca67fb74
SHA256

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313
SHA512

dde4489c467d232c5b8e7930ff0991c33aa1477666984bf69559556229b5a76951015fe38993d7289acb5aa5e9661126ed1ac9878cf44a4fbf9b06e57e1275b4
SSDEEP

49152:SMQyNFL4gSeOzD5rbhdU7bSVziW+Gz/6Sq5ms7Otvx2mAmMm0pFZMpTBkRdFFU2:NL4B35rbhCkiStvx2GcFZM1BOU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2092-133-0x0000000000720000-0x0000000000A9E000-memory.dmp	vmprotect

Kills process with taskkill 1 IoCs

evasion

pid	Process
1968	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
Token: SeDebugPrivilege	1968	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4832	2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	89
PID 2092 wrote to memory of 4832	2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	89
PID 2092 wrote to memory of 4832	2092	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	89
PID 4832 wrote to memory of 1968	4832	cmd.exe	91
PID 4832 wrote to memory of 1968	4832	cmd.exe	91
PID 4832 wrote to memory of 1968	4832	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c taskkill /F /IM 7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM 7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-133-0x0000000000720000-0x0000000000A9E000-memory.dmp

Filesize
3.5MB

Download
memory/2092-134-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2092-135-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2092-136-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/2092-137-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-138-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/2092-139-0x0000000005E20000-0x00000000063C4000-memory.dmp

Filesize
5.6MB

Download
memory/2092-140-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/2092-141-0x00000000054E0000-0x00000000054EA000-memory.dmp

Filesize
40KB

Download
memory/2092-142-0x0000000005A70000-0x0000000005AC6000-memory.dmp

Filesize
344KB

Download
memory/2092-143-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-144-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2092-145-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-146-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2092-147-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-148-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-152-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2092-153-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download