Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
06-08-2023 09:44
General
-
Target
7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
-
Size
37KB
-
MD5
27f40a5673ac55f47d781331ef416de6
-
SHA1
2391e533a1c95f8fd20ee73cac60f5971bdd9f0b
-
SHA256
7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90
-
SHA512
dde5c40ee024a7a6e5a872f6ef1b2e102dfd9e9e2dbe1bea2810cdc738ee79b0ee5bc4d1330aa1ec4abab74bff1899ec5103acc4154cf97c1a13da875904b08e
-
SSDEEP
384:8kqBkiyjnDNGRn5IyUvapIrPbh+/VsIt6xrAF+rMRTyN/0L+EcoinblneHQM3epW:X35M5jUvairANsIQxrM+rMRa8NuCzt
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe" "7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe" ENABLE2⤵
- Modifies Windows Firewall
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB