Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 15:55
Static task
static1
Behavioral task
behavioral1
Sample
70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe
-
Size
1.9MB
-
MD5
534e8c1d3d71f8736793b80048c3dbdd
-
SHA1
d651b9cf8a717609656f13183ac1c9128e5c9105
-
SHA256
70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade
-
SHA512
3816f5c4bc1f0bb3466ec59257ab98914c3b0f3348942d01e8ab661cc071a89f2e4eb943ecd467f0710cb0fbf3a04e008a43d6a9277e725f97dec798abad2fc5
-
SSDEEP
24576:eGgZShKmrSYSvcrWgzZTqZ8u+gJHE3nY0AdxPQaXm7sqUF0MU8GO0bb:ee+eWghqbEGdxPRWQqy0MU8GPb
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2072 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 28 PID 1968 wrote to memory of 2072 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 28 PID 1968 wrote to memory of 2072 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 28 PID 1968 wrote to memory of 2072 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 28 PID 1968 wrote to memory of 2848 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 29 PID 1968 wrote to memory of 2848 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 29 PID 1968 wrote to memory of 2848 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 29 PID 1968 wrote to memory of 2848 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 29 PID 1968 wrote to memory of 2304 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 30 PID 1968 wrote to memory of 2304 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 30 PID 1968 wrote to memory of 2304 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 30 PID 1968 wrote to memory of 2304 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 30 PID 1968 wrote to memory of 2208 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 31 PID 1968 wrote to memory of 2208 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 31 PID 1968 wrote to memory of 2208 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 31 PID 1968 wrote to memory of 2208 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 31 PID 1968 wrote to memory of 1396 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 32 PID 1968 wrote to memory of 1396 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 32 PID 1968 wrote to memory of 1396 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 32 PID 1968 wrote to memory of 1396 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 32 PID 1968 wrote to memory of 2324 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 33 PID 1968 wrote to memory of 2324 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 33 PID 1968 wrote to memory of 2324 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 33 PID 1968 wrote to memory of 2324 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 33 PID 1968 wrote to memory of 2312 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 34 PID 1968 wrote to memory of 2312 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 34 PID 1968 wrote to memory of 2312 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 34 PID 1968 wrote to memory of 2312 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 34 PID 1968 wrote to memory of 2632 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 35 PID 1968 wrote to memory of 2632 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 35 PID 1968 wrote to memory of 2632 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 35 PID 1968 wrote to memory of 2632 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 35 PID 1968 wrote to memory of 2640 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 36 PID 1968 wrote to memory of 2640 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 36 PID 1968 wrote to memory of 2640 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 36 PID 1968 wrote to memory of 2640 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 36 PID 1968 wrote to memory of 2700 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 37 PID 1968 wrote to memory of 2700 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 37 PID 1968 wrote to memory of 2700 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 37 PID 1968 wrote to memory of 2700 1968 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe"C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2072
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exeC:\Users\Admin\AppData\Local\Temp\70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade_JC.exe2⤵PID:2700
-