b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87

Resubmissions

07/12/2023, 00:24

06/12/2023, 23:45

max time kernel
432s
max time network
433s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
06/12/2023, 23:45

Target

Jigsaw.zip
Size

239KB
MD5

bccd9fe85eb31117cfe1fd877dd08fcd
SHA1

a4c89e4d1290b392e967483979dba92f3309f2bd
SHA256

b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87
SHA512

ca98d1c354a596c36a3e85a6f11478d3401bd8a1b8b9bc5dbb8504c30db5f0bf3e662977b627d4ae64ffc58a2bbf7ba902364c9554d66897f64964afb15173bb
SSDEEP

6144:5/vucHCQQQEwuyjADlZZuxcntYVecfdth:5OcitByWHu2eVecf9

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3952	1056	2773e3dc59472296cb0024ba7715a64e.exe	92
PID 1056 wrote to memory of 3952	1056	2773e3dc59472296cb0024ba7715a64e.exe	92
PID 2332 wrote to memory of 3732	2332	2773e3dc59472296cb0024ba7715a64e.exe	94
PID 2332 wrote to memory of 3732	2332	2773e3dc59472296cb0024ba7715a64e.exe	94

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Jigsaw.zip
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1900

C:\Users\Admin\Desktop\2773e3dc59472296cb0024ba7715a64e.exe
"C:\Users\Admin\Desktop\2773e3dc59472296cb0024ba7715a64e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:3952

C:\Users\Admin\Desktop\2773e3dc59472296cb0024ba7715a64e.exe
"C:\Users\Admin\Desktop\2773e3dc59472296cb0024ba7715a64e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:3732

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
597e77be71bc1b1bc2c0147f0cfd0a37

SHA1
d1317f05e475077ca76f0546037c42ed6e776683

SHA256
16a86e049d3bec0cf072e336029a021e40c28842917d195c2a904e0db66a7d1a

SHA512
b37855118d49772cfa37bf5a2b2625c5468ab7a15bc8b2ecf036c6c9433a998b6d1963889a70ffcfaa38dd3639119cd39989b869e96af33502b61dc6394546e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jigsaw.zip

Filesize
239KB

MD5
bccd9fe85eb31117cfe1fd877dd08fcd

SHA1
a4c89e4d1290b392e967483979dba92f3309f2bd

SHA256
b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87

SHA512
ca98d1c354a596c36a3e85a6f11478d3401bd8a1b8b9bc5dbb8504c30db5f0bf3e662977b627d4ae64ffc58a2bbf7ba902364c9554d66897f64964afb15173bb

Download Submit