94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 14:22

Target

94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
Size

324KB
MD5

89b8d436638c87292a671a9fffa05935
SHA1

518d7dbf1665959b7767e970806d76bf9fa03875
SHA256

94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c
SHA512

585e1833f7bdc5bb087b635103ae924f34358d001aea64ccb98c600d74ec483f41f93e0433fd6d56c6e4f3a10bdde2627fac445564a880ed3d3e4eb82ce45442
SSDEEP

6144:/Ya6wSIdz6ZiYpeAA9TbgAtkRu9b6yNfZ6IicllI:/Yez+Zi64JgAtk856WMI5I

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 3260	2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3260	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
3260	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3260	2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	80
PID 2000 wrote to memory of 3260	2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	80
PID 2000 wrote to memory of 3260	2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	80
PID 2000 wrote to memory of 3260	2000	94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\94f494962805c4cae1a0295d20db44ac8a42f4a6447a5856f17716c8f146844c_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsy76B8.tmp\hvkvrxv.dll

Filesize
110KB

MD5
f64469a631238b167b0bda1194e85243

SHA1
2b9e24cdb1cf6307cfbc4bc8c25103f2a12acb9d

SHA256
8bb05744062bdf97c8c1c6c0f34d2ff221a9fe04913f4c296a2fdba6d0d48ad1

SHA512
86965a3c57402561b848dbc989d9d25ff93f3ac974ec76dce0e1625a6fc459a8c8b505eb9097e3f2206d3ed4e1cc177b54e9a74824973cede95c19af364924d0

Download Submit
memory/2000-6-0x00000000031A0000-0x00000000031A2000-memory.dmp

Filesize
8KB

Download
memory/3260-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3260-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3260-9-0x0000000000B40000-0x0000000000E8A000-memory.dmp

Filesize
3.3MB

Download
memory/3260-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download