Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 19:00
Behavioral task
behavioral1
Sample
690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe
Resource
win7-20230712-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe
-
Size
32KB
-
MD5
0e033806f3e80c452e64c7c4c90b6c2d
-
SHA1
fefa566696f6de4f31c54939e5fa729d8ff5d8da
-
SHA256
690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3
-
SHA512
2478a3a0a7bf486444ff6b8b43bb8a08c832c062e76ad7265cd35b2984f1980e6462141fffc1e02fd93aaa3a3c4129a2b8067579080b745f1212c02c484b867b
-
SSDEEP
384:nC0bUe5XB4e0XOOVFggUBZIGfWTHtTUFQqzFiObb/:nbT9BuNDggUBZIp0b/
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe Token: 33 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe Token: SeIncBasePriorityPrivilege 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3604 wrote to memory of 2132 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe 89 PID 3604 wrote to memory of 2132 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe 89 PID 3604 wrote to memory of 2132 3604 690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe"C:\Users\Admin\AppData\Local\Temp\690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\690d9e3707bb18937e5dba980bc33136b6d8220f421c7f38db4229387c552ec3_JC.exe"2⤵PID:2132
-