Analysis

  • max time kernel
    154s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 21:35

General

  • Target

    c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe

  • Size

    124KB

  • MD5

    c2366c6bdbe1cf73d9a5143bdfb174be

  • SHA1

    af6d1f0615d206a1cf5924d35ed39c581e2b498a

  • SHA256

    e19e92308a0f36cf3de48aba6d968d47e1776105622c47481c20c76600ac4af9

  • SHA512

    d1cacab1421573dc360cf4d4e4bc3a5045f7e840b94b76b71734f7e81414449440b31de367ad9df04a34642ecc20d87b8f0913d5a23558ceb5edae1bdfcb2b9b

  • SSDEEP

    3072:a27TcK5uQxqTvCIDw0x+G3dF/Ytq7xIpNelN:/cguamrL/v7xIpNiN

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\SysWOW64\svchost.exe
      C:\ProgramData\a805f578.exe
      2⤵
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2076
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\ProgramData\kxa9886.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe""
      2⤵
        PID:2164

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\kxa9886.tmp.bat

      Filesize

      31B

      MD5

      bb5dab0ac99d22e5bfa71a5b5430de79

      SHA1

      01ee96718503a802ab8f8e0ef8087352faa75037

      SHA256

      f7dfd5ea595bf83a0c0cfbc2d434c9888073c33d59818cc9d2a62cb44ce4b1d4

      SHA512

      48ffda59852223224e69417f7d1f46beafe66e1b3effca5706874d53ccc40d94be445c79a45e085afa6a1433058a3178526ea8d803dc9ce38c2fc336d8bfd729

    • C:\ProgramData\kxa9886.tmp.bat

      Filesize

      31B

      MD5

      bb5dab0ac99d22e5bfa71a5b5430de79

      SHA1

      01ee96718503a802ab8f8e0ef8087352faa75037

      SHA256

      f7dfd5ea595bf83a0c0cfbc2d434c9888073c33d59818cc9d2a62cb44ce4b1d4

      SHA512

      48ffda59852223224e69417f7d1f46beafe66e1b3effca5706874d53ccc40d94be445c79a45e085afa6a1433058a3178526ea8d803dc9ce38c2fc336d8bfd729

    • memory/2076-300-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-317-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-292-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-294-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-295-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-296-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-291-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-287-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-288-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-299-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-2-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-302-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-290-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-306-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-303-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-308-0x0000000000180000-0x0000000000190000-memory.dmp

      Filesize

      64KB

    • memory/2076-312-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-313-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-314-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-315-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-316-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-304-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-319-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB

    • memory/2076-320-0x0000000000130000-0x0000000000161000-memory.dmp

      Filesize

      196KB

    • memory/2076-322-0x0000000000560000-0x0000000000660000-memory.dmp

      Filesize

      1024KB