b3eb88e68a28925ff35d869aa4c236264d1be6a8a2b40b0d0ec51d2517ab0408

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

jewel.sfx.exe
Size

2.1MB
MD5

aa36c446e2ba06202d5384bb8ad6137f
SHA1

3be8f31855bde46aaab47186ed9ab474e5a515e9
SHA256

b3eb88e68a28925ff35d869aa4c236264d1be6a8a2b40b0d0ec51d2517ab0408
SHA512

833540a2b00dcbaf1f31949604665130c55eef9d35bf3bf89ee15650c69bd0c6ade98e408c51ff0fc6a11dab0389bf6964c523a6cf8d10f5b98c02671b00c541
SSDEEP

49152:JrA7v2LPKPjt98HhNIPPue2+0UK0JoAWv/uZurFLY4GDYv9:Jr+APKPz8BuHuGzK1/uobIY1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	jewel.sfx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	jewel.sfx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	jewel.sfx.exe
2656	jewel.sfx.exe

C:\Users\Admin\AppData\Local\Temp\jewel.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\jewel.sfx.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads