94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 14:22

Target

94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
Size

324KB
MD5

89b8d436638c87292a671a9fffa05935
SHA1

518d7dbf1665959b7767e970806d76bf9fa03875
SHA256

94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c
SHA512

585e1833f7bdc5bb087b635103ae924f34358d001aea64ccb98c600d74ec483f41f93e0433fd6d56c6e4f3a10bdde2627fac445564a880ed3d3e4eb82ce45442
SSDEEP

6144:/Ya6wSIdz6ZiYpeAA9TbgAtkRu9b6yNfZ6IicllI:/Yez+Zi64JgAtk856WMI5I

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1652	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28
PID 2040 wrote to memory of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28
PID 2040 wrote to memory of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28
PID 2040 wrote to memory of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28
PID 2040 wrote to memory of 1652	2040	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsy7042.tmp\hvkvrxv.dll

Filesize
110KB

MD5
f64469a631238b167b0bda1194e85243

SHA1
2b9e24cdb1cf6307cfbc4bc8c25103f2a12acb9d

SHA256
8bb05744062bdf97c8c1c6c0f34d2ff221a9fe04913f4c296a2fdba6d0d48ad1

SHA512
86965a3c57402561b848dbc989d9d25ff93f3ac974ec76dce0e1625a6fc459a8c8b505eb9097e3f2206d3ed4e1cc177b54e9a74824973cede95c19af364924d0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy7042.tmp\hvkvrxv.dll

Filesize
110KB

MD5
f64469a631238b167b0bda1194e85243

SHA1
2b9e24cdb1cf6307cfbc4bc8c25103f2a12acb9d

SHA256
8bb05744062bdf97c8c1c6c0f34d2ff221a9fe04913f4c296a2fdba6d0d48ad1

SHA512
86965a3c57402561b848dbc989d9d25ff93f3ac974ec76dce0e1625a6fc459a8c8b505eb9097e3f2206d3ed4e1cc177b54e9a74824973cede95c19af364924d0

Download Submit
memory/1652-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1652-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1652-9-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download
memory/2040-7-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download