845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
Size

1.6MB
MD5

f8fcbb9dc832d62a75f5b3cf59015b05
SHA1

ad0b9d464c0ce04b7dabfb1104df10ae241b104b
SHA256

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00
SHA512

ffaafdfddd5f67b938c3adec185d18ae4b88215f6e263c656475985154cf624998e62abffa85be8916f6a93c147ba5071f192f3987312c80336b0d081cddb576
SSDEEP

24576:IxBty9XUrbcO3faYAPbXRnUgdKA026BNEam/eYeUUUJaJaGjfg71JkvG:aLuYQYAPbXRvqBNZDK1JSG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79
PID 3940 wrote to memory of 640	3940	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	79

C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
"C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-31-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/640-36-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/640-34-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/640-33-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3940-18-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-24-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-6-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-8-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-10-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-12-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-14-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-16-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-0-0x0000000000FF0000-0x0000000001188000-memory.dmp

Filesize
1.6MB

Download
memory/3940-20-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-22-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-5-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-26-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-28-0x0000000003530000-0x0000000003545000-memory.dmp

Filesize
84KB

Download
memory/3940-29-0x0000000005B80000-0x0000000005B90000-memory.dmp

Filesize
64KB

Download
memory/3940-30-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/3940-4-0x0000000003530000-0x000000000354C000-memory.dmp

Filesize
112KB

Download
memory/3940-3-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3940-35-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3940-2-0x0000000005C10000-0x0000000005CAC000-memory.dmp

Filesize
624KB

Download
memory/3940-1-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads