Analysis
-
max time kernel
154s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
-
Size
124KB
-
MD5
c2366c6bdbe1cf73d9a5143bdfb174be
-
SHA1
af6d1f0615d206a1cf5924d35ed39c581e2b498a
-
SHA256
e19e92308a0f36cf3de48aba6d968d47e1776105622c47481c20c76600ac4af9
-
SHA512
d1cacab1421573dc360cf4d4e4bc3a5045f7e840b94b76b71734f7e81414449440b31de367ad9df04a34642ecc20d87b8f0913d5a23558ceb5edae1bdfcb2b9b
-
SSDEEP
3072:a27TcK5uQxqTvCIDw0x+G3dF/Ytq7xIpNelN:/cguamrL/v7xIpNiN
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelPowerAgent4 = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\\PROGRA~3\\a805f578.exe" svchost.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Avira svchost.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\AVAST Software\Avast svchost.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Eset\Nod svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2692 set thread context of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 PID 2692 wrote to memory of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 PID 2692 wrote to memory of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 PID 2692 wrote to memory of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 PID 2692 wrote to memory of 2076 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 28 PID 2692 wrote to memory of 2164 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 29 PID 2692 wrote to memory of 2164 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 29 PID 2692 wrote to memory of 2164 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 29 PID 2692 wrote to memory of 2164 2692 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe"C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\svchost.exeC:\ProgramData\a805f578.exe2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
PID:2076
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\ProgramData\kxa9886.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe""2⤵PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31B
MD5bb5dab0ac99d22e5bfa71a5b5430de79
SHA101ee96718503a802ab8f8e0ef8087352faa75037
SHA256f7dfd5ea595bf83a0c0cfbc2d434c9888073c33d59818cc9d2a62cb44ce4b1d4
SHA51248ffda59852223224e69417f7d1f46beafe66e1b3effca5706874d53ccc40d94be445c79a45e085afa6a1433058a3178526ea8d803dc9ce38c2fc336d8bfd729
-
Filesize
31B
MD5bb5dab0ac99d22e5bfa71a5b5430de79
SHA101ee96718503a802ab8f8e0ef8087352faa75037
SHA256f7dfd5ea595bf83a0c0cfbc2d434c9888073c33d59818cc9d2a62cb44ce4b1d4
SHA51248ffda59852223224e69417f7d1f46beafe66e1b3effca5706874d53ccc40d94be445c79a45e085afa6a1433058a3178526ea8d803dc9ce38c2fc336d8bfd729