Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8f933b1bdaaf7622803a17d3a1704a9_JC.exe
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8f933b1bdaaf7622803a17d3a1704a9_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b8f933b1bdaaf7622803a17d3a1704a9_JC.exe
-
Size
6.2MB
-
MD5
b8f933b1bdaaf7622803a17d3a1704a9
-
SHA1
53bca54b9d1ed076a6f8dc09d35af06706365249
-
SHA256
d5c740041c08927bac1d5b99d55d6bb1d6308e5208098bc49e4d9ee4b02e12b4
-
SHA512
7fe259d40ca1cb0ab8ab194438595cba41fc36cc5e248e1d22315fb7c6278c44b4d47c15f550ae553c99ac5c4962a26e078aceb0d2bc0135885e53fb4cf62d6a
-
SSDEEP
196608:u0/C315uu40siCd5ckTR2pOwtc4qVLnZzVA8lIImrbol:f/C7uBFTcpfERZ5Aksrbol
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" b8f933b1bdaaf7622803a17d3a1704a9_JC.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\MavInject32.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX829C.tmp b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\mip.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX821D.tmp b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX82DB.tmp b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\sIRC4.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe b8f933b1bdaaf7622803a17d3a1704a9_JC.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5e1c1bb527d4c5e74bb7680f88d02ebf1
SHA1013c5a1f4c43991327f364cdb745cb65794ff18a
SHA2565ced63addd10718ad27b263dd85c792264e75b1131ce85acc86a6c390707bc78
SHA512827171a94250920dd676e92e753edd729d5512a5a2a7c2996895c38bd0963060de327601669f1133b82ab2c15fe195c2feae28f147b7d79ef9ae3bbff32ab240
-
Filesize
6.2MB
MD5f560a57833da43c14fa2442642c7c844
SHA1a48cb0c2c586b165984976fe3caa4ce427c7a0e6
SHA256c6d03cadec11993753917ad047bd1197d4016155ef54942aa219c7f7dfcf6551
SHA512e81e78ad5716664c89fba7e8417333a8dab01176e09f0d9b3eed03998b33313e1b8349cbab6eafda415e720b96207005ed9d5a6fdd3550d7d90619d8413b143b