6c104addbf9a6a5f3921b02edadf5f48b0975a609dd5cf7d1010f4c29afb8186

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10aabe1c6225e6df33990b8f9e6e0820_JC.exe
Size

672KB
MD5

10aabe1c6225e6df33990b8f9e6e0820
SHA1

21bbb6e7fac0f86c1c0641bcbe85481530cd2478
SHA256

6c104addbf9a6a5f3921b02edadf5f48b0975a609dd5cf7d1010f4c29afb8186
SHA512

3c332e7539102cd7eaa4fcdd8f58b56132073c1443069a271e8fd86975a946baa85f2ca5a59c1eaf2fa698444b0904b8c298fcf79e405427451963b2bd2d1e4b
SSDEEP

12288:0ANAu3yx+XQsiE9SULxIe4Hnlq2PyHsvAYhWWHq7UB:0ANa+XQsiE5IlsHsvA/W

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe
2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 372	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	5
PID 2716 wrote to memory of 372	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	5
PID 2716 wrote to memory of 372	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	5
PID 2716 wrote to memory of 372	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	5
PID 2716 wrote to memory of 372	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	5
PID 2716 wrote to memory of 384	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	4
PID 2716 wrote to memory of 384	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	4
PID 2716 wrote to memory of 384	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	4
PID 2716 wrote to memory of 384	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	4
PID 2716 wrote to memory of 384	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	4
PID 2716 wrote to memory of 420	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	3
PID 2716 wrote to memory of 420	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	3
PID 2716 wrote to memory of 420	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	3
PID 2716 wrote to memory of 420	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	3
PID 2716 wrote to memory of 420	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	3
PID 2716 wrote to memory of 464	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	2
PID 2716 wrote to memory of 464	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	2
PID 2716 wrote to memory of 464	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	2
PID 2716 wrote to memory of 464	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	2
PID 2716 wrote to memory of 464	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	2
PID 2716 wrote to memory of 484	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	1
PID 2716 wrote to memory of 484	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	1
PID 2716 wrote to memory of 484	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	1
PID 2716 wrote to memory of 484	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	1
PID 2716 wrote to memory of 484	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	1
PID 2716 wrote to memory of 492	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	8
PID 2716 wrote to memory of 492	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	8
PID 2716 wrote to memory of 492	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	8
PID 2716 wrote to memory of 492	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	8
PID 2716 wrote to memory of 492	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	8
PID 2716 wrote to memory of 608	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	27
PID 2716 wrote to memory of 608	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	27
PID 2716 wrote to memory of 608	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	27
PID 2716 wrote to memory of 608	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	27
PID 2716 wrote to memory of 608	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	27
PID 2716 wrote to memory of 684	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	26
PID 2716 wrote to memory of 684	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	26
PID 2716 wrote to memory of 684	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	26
PID 2716 wrote to memory of 684	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	26
PID 2716 wrote to memory of 684	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	26
PID 2716 wrote to memory of 768	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	9
PID 2716 wrote to memory of 768	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	9
PID 2716 wrote to memory of 768	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	9
PID 2716 wrote to memory of 768	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	9
PID 2716 wrote to memory of 768	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	9
PID 2716 wrote to memory of 812	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	25
PID 2716 wrote to memory of 812	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	25
PID 2716 wrote to memory of 812	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	25
PID 2716 wrote to memory of 812	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	25
PID 2716 wrote to memory of 812	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	25
PID 2716 wrote to memory of 856	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	24
PID 2716 wrote to memory of 856	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	24
PID 2716 wrote to memory of 856	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	24
PID 2716 wrote to memory of 856	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	24
PID 2716 wrote to memory of 856	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	24
PID 2716 wrote to memory of 968	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	10
PID 2716 wrote to memory of 968	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	10
PID 2716 wrote to memory of 968	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	10
PID 2716 wrote to memory of 968	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	10
PID 2716 wrote to memory of 968	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	10
PID 2716 wrote to memory of 240	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	22
PID 2716 wrote to memory of 240	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	22
PID 2716 wrote to memory of 240	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	22
PID 2716 wrote to memory of 240	2716	10aabe1c6225e6df33990b8f9e6e0820_JC.exe	22

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:768
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:968
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:488
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1132
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2268
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2340
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:240
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:684
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:608

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1224

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\10aabe1c6225e6df33990b8f9e6e0820_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\10aabe1c6225e6df33990b8f9e6e0820_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2344

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-0-0x0000000001000000-0x00000000010AF000-memory.dmp

Filesize
700KB

Download
memory/2716-2-0x0000000077D4F000-0x0000000077D50000-memory.dmp

Filesize
4KB

Download
memory/2716-1-0x0000000077D50000-0x0000000077D51000-memory.dmp

Filesize
4KB

Download
memory/2716-3-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-4-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-5-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-6-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-7-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-8-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2716-9-0x0000000001000000-0x00000000010AF000-memory.dmp

Filesize
700KB

Download