Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
20-08-2023 11:36
General
-
Target
54ec929ab868528d647d285298b5ab71ef9aad83e1a3594b3d13f2a02f127d96_JC.exe
-
Size
753KB
-
MD5
d0b5e28ea7fe6421a78f3e73c49ce5e2
-
SHA1
73c172755dfcc9b5762a7410497f4da86264a359
-
SHA256
54ec929ab868528d647d285298b5ab71ef9aad83e1a3594b3d13f2a02f127d96
-
SHA512
3332f4431b0ff9743de47ac7d412556010c529ca1b34ee2d0aa717b29e425312c8faac4e4c90172f19e69dcd7a782f9afc3613ffc365fde491be00485d492cb0
-
SSDEEP
12288:AtBCeu+x9twSZxex8EmVIXe5f+8xzPFXvpNMW4:UBCeu+5U6IO5W8xzdnMJ
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ec929ab868528d647d285298b5ab71ef9aad83e1a3594b3d13f2a02f127d96_JC.exe"C:\Users\Admin\AppData\Local\Temp\54ec929ab868528d647d285298b5ab71ef9aad83e1a3594b3d13f2a02f127d96_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
776KB
-
Filesize
256KB
-
Filesize
88KB
-
Filesize
6.9MB
-
Filesize
472KB
-
Filesize
6.9MB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
3.0MB
-
Filesize
212KB