2b3fbb77e5ed29f7ffbcb9a73cc1e467aed6447fcaf28a47d50f78c81fa17eaf

Analysis

max time kernel
5s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

678KB
MD5

6c81e39fd156891a6e8bbf3d8355e54b
SHA1

3dba98dfcb96bed3f63e8d7524458127d1f8e877
SHA256

2b3fbb77e5ed29f7ffbcb9a73cc1e467aed6447fcaf28a47d50f78c81fa17eaf
SHA512

664bc397ce092bc555e4a0139607bf66993e5537d13e09c2f604bbbda4be081f85e2e0b4664e8525ecdb45509082d06ff2105808b6e3707930623718d0b3c51c
SSDEEP

12288:cjY/CBAkfIulEPWZmmdtpTkUtBYDxnnz5/ikp3tW9zgOX4sRqG1sqAQO1:F/C6kXNlS5KkqBnqGqqAQO1

Score

8^/10

evasion upx

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
4888	netsh.exe
1772	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J41MiyGLVaP0VwPHm4cAGenH.bat	jsc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2392-0-0x00007FF7EBE10000-0x00007FF7EC01B000-memory.dmp	upx
behavioral2/memory/2392-2-0x00007FF7EBE10000-0x00007FF7EC01B000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 1180	2392	file.exe	14

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4116	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4672	860	WerFault.exe	91
1128	4348	WerFault.exe	97

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3480	schtasks.exe
1308	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	jsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14
PID 2392 wrote to memory of 1180	2392	file.exe	14

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1180
- C:\Users\Admin\Pictures\7amyan9gsk51cDMKEzcFPBmb.exe
  "C:\Users\Admin\Pictures\7amyan9gsk51cDMKEzcFPBmb.exe"
  2⤵
  PID:860
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1564
- - C:\Users\Admin\Pictures\7amyan9gsk51cDMKEzcFPBmb.exe
    "C:\Users\Admin\Pictures\7amyan9gsk51cDMKEzcFPBmb.exe"
    3⤵
    PID:4236
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2792
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4452
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2152
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:3480
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:2160
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:1308
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        
        PID:1780
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        
        PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 928
    3⤵
    - Program crash
    PID:4672
- C:\Users\Admin\Pictures\wFSvDtzag1hHgwVfDuWPHKbI.exe
  "C:\Users\Admin\Pictures\wFSvDtzag1hHgwVfDuWPHKbI.exe"
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 624
    3⤵
    - Program crash
    PID:1128
- - C:\Users\Admin\Pictures\wFSvDtzag1hHgwVfDuWPHKbI.exe
    "C:\Users\Admin\Pictures\wFSvDtzag1hHgwVfDuWPHKbI.exe"
    3⤵
    PID:732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:2904
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4028
- C:\Users\Admin\Pictures\1R4DyXA0EkvTe2GTH2Q0Ljqh.exe
  "C:\Users\Admin\Pictures\1R4DyXA0EkvTe2GTH2Q0Ljqh.exe"
  2⤵
  PID:4536

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 860 -ip 860
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4348 -ip 4348
1⤵
PID:2636

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:4888

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-441-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-715-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-422-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-431-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-433-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-435-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-437-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-439-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-713-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-711-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/544-443-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/732-339-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/732-162-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/732-161-0x0000000002E10000-0x00000000036FB000-memory.dmp

Filesize
8.9MB

Download
memory/732-160-0x0000000002A10000-0x0000000002E0B000-memory.dmp

Filesize
4.0MB

Download
memory/860-40-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/860-39-0x0000000002F00000-0x00000000037EB000-memory.dmp

Filesize
8.9MB

Download
memory/860-38-0x0000000002B00000-0x0000000002EFA000-memory.dmp

Filesize
4.0MB

Download
memory/860-122-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/860-93-0x0000000002B00000-0x0000000002EFA000-memory.dmp

Filesize
4.0MB

Download
memory/1180-4-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/1180-3-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/1180-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1180-77-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-73-0x0000000008120000-0x000000000879A000-memory.dmp

Filesize
6.5MB

Download
memory/1564-60-0x00000000067A0000-0x00000000067EC000-memory.dmp

Filesize
304KB

Download
memory/1564-41-0x0000000003130000-0x0000000003166000-memory.dmp

Filesize
216KB

Download
memory/1564-80-0x0000000007C70000-0x0000000007CA2000-memory.dmp

Filesize
200KB

Download
memory/1564-82-0x000000006F580000-0x000000006F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/1564-94-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/1564-96-0x0000000007DC0000-0x0000000007DCA000-memory.dmp

Filesize
40KB

Download
memory/1564-95-0x0000000007CD0000-0x0000000007D73000-memory.dmp

Filesize
652KB

Download
memory/1564-43-0x0000000005820000-0x0000000005E48000-memory.dmp

Filesize
6.2MB

Download
memory/1564-98-0x0000000007E80000-0x0000000007F16000-memory.dmp

Filesize
600KB

Download
memory/1564-45-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/1564-110-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

Filesize
68KB

Download
memory/1564-47-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/1564-58-0x0000000006230000-0x0000000006584000-memory.dmp

Filesize
3.3MB

Download
memory/1564-92-0x0000000007CB0000-0x0000000007CCE000-memory.dmp

Filesize
120KB

Download
memory/1564-81-0x000000006F530000-0x000000006F57C000-memory.dmp

Filesize
304KB

Download
memory/1564-111-0x0000000007E20000-0x0000000007E2E000-memory.dmp

Filesize
56KB

Download
memory/1564-112-0x0000000007E30000-0x0000000007E44000-memory.dmp

Filesize
80KB

Download
memory/1564-113-0x0000000007F20000-0x0000000007F3A000-memory.dmp

Filesize
104KB

Download
memory/1564-114-0x0000000007E70000-0x0000000007E78000-memory.dmp

Filesize
32KB

Download
memory/1564-117-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-48-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/1564-74-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Filesize
104KB

Download
memory/1564-46-0x0000000005E80000-0x0000000005EA2000-memory.dmp

Filesize
136KB

Download
memory/1564-59-0x00000000066F0000-0x000000000670E000-memory.dmp

Filesize
120KB

Download
memory/1564-44-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/1564-42-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-61-0x0000000006AE0000-0x0000000006B24000-memory.dmp

Filesize
272KB

Download
memory/1564-72-0x0000000007A20000-0x0000000007A96000-memory.dmp

Filesize
472KB

Download
memory/1780-429-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1820-151-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1820-150-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/1820-163-0x000000006F530000-0x000000006F57C000-memory.dmp

Filesize
304KB

Download
memory/1820-165-0x000000007F5C0000-0x000000007F5D0000-memory.dmp

Filesize
64KB

Download
memory/2392-0-0x00007FF7EBE10000-0x00007FF7EC01B000-memory.dmp

Filesize
2.0MB

Download
memory/2392-2-0x00007FF7EBE10000-0x00007FF7EC01B000-memory.dmp

Filesize
2.0MB

Download
memory/2912-127-0x000000006F580000-0x000000006F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2912-108-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/2912-126-0x000000006F530000-0x000000006F57C000-memory.dmp

Filesize
304KB

Download
memory/2912-137-0x0000000007C60000-0x0000000007D03000-memory.dmp

Filesize
652KB

Download
memory/2912-139-0x0000000007D60000-0x0000000007D71000-memory.dmp

Filesize
68KB

Download
memory/2912-156-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/2912-152-0x0000000007DC0000-0x0000000007DD4000-memory.dmp

Filesize
80KB

Download
memory/2912-97-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/2912-138-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/2912-109-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/2912-125-0x000000007FDD0000-0x000000007FDE0000-memory.dmp

Filesize
64KB

Download
memory/4236-320-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4236-123-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4236-164-0x0000000002980000-0x0000000002D7C000-memory.dmp

Filesize
4.0MB

Download
memory/4236-120-0x0000000002980000-0x0000000002D7C000-memory.dmp

Filesize
4.0MB

Download
memory/4348-158-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4348-124-0x0000000002A70000-0x0000000002E70000-memory.dmp

Filesize
4.0MB

Download
memory/4348-76-0x0000000002A70000-0x0000000002E70000-memory.dmp

Filesize
4.0MB

Download
memory/4348-78-0x0000000002E70000-0x000000000375B000-memory.dmp

Filesize
8.9MB

Download
memory/4348-140-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4348-79-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4536-470-0x0000000004210000-0x0000000004E38000-memory.dmp

Filesize
12.2MB

Download
memory/4536-474-0x0000000004E40000-0x0000000004E7A000-memory.dmp

Filesize
232KB

Download
memory/4536-465-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/4632-432-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4632-436-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads