845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
Size

1.6MB
MD5

f8fcbb9dc832d62a75f5b3cf59015b05
SHA1

ad0b9d464c0ce04b7dabfb1104df10ae241b104b
SHA256

845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00
SHA512

ffaafdfddd5f67b938c3adec185d18ae4b88215f6e263c656475985154cf624998e62abffa85be8916f6a93c147ba5071f192f3987312c80336b0d081cddb576
SSDEEP

24576:IxBty9XUrbcO3faYAPbXRnUgdKA026BNEam/eYeUUUJaJaGjfg71JkvG:aLuYQYAPbXRvqBNZDK1JSG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90
PID 4532 wrote to memory of 1160	4532	845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe
"C:\Users\Admin\AppData\Local\Temp\845b3e0ef3bf0235321063d4ffbd013212abcaa9b4104eae1706902214c38e00_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-31-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1160-33-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1160-34-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1160-36-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4532-30-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/4532-35-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-6-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-8-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-18-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-24-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-29-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4532-28-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-0-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-4-0x00000000027B0000-0x00000000027CC000-memory.dmp

Filesize
112KB

Download
memory/4532-3-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-5-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-2-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

Filesize
624KB

Download
memory/4532-1-0x0000000000210000-0x00000000003A8000-memory.dmp

Filesize
1.6MB

Download
memory/4532-26-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-22-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-20-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-16-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-14-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-12-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download
memory/4532-10-0x00000000027B0000-0x00000000027C5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads