Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
821bbfc8f0a946efd3d8c9b8aa6d68ee.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
821bbfc8f0a946efd3d8c9b8aa6d68ee.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
821bbfc8f0a946efd3d8c9b8aa6d68ee.exe
-
Size
6.0MB
-
MD5
821bbfc8f0a946efd3d8c9b8aa6d68ee
-
SHA1
5bf3f157d56a61fb4ebb92a35664aafcceb2b943
-
SHA256
7b5cb683875a42757083a2e02fb6cc54d1f472569fc3d570992a18ac019f722e
-
SHA512
c1ab71e6be5d67fa6fcae1b58c1f8528ebbda63cd790640fae6ebc1229b5cb85583abad16839d72e100dd393045a3ec322a81107a25ce38a3da319389915094d
-
SSDEEP
98304:vBsvwVReAo6kSF8yYZl1gpJhFEo2ylLj0bsk4BAH6+6TEE:vBaanoJ5ZleLhKKbtY6bEE
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
821bbfc8f0a946efd3d8c9b8aa6d68ee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\821bbfc8f0a946efd3d8c9b8aa6d68ee = "C:\\Users\\Admin\\821bbfc8f0a946efd3d8c9b8aa6d68ee.exe" 821bbfc8f0a946efd3d8c9b8aa6d68ee.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
821bbfc8f0a946efd3d8c9b8aa6d68ee.exedescription pid process target process PID 768 wrote to memory of 4248 768 821bbfc8f0a946efd3d8c9b8aa6d68ee.exe jsc.exe PID 768 wrote to memory of 4248 768 821bbfc8f0a946efd3d8c9b8aa6d68ee.exe jsc.exe PID 768 wrote to memory of 4248 768 821bbfc8f0a946efd3d8c9b8aa6d68ee.exe jsc.exe PID 768 wrote to memory of 4248 768 821bbfc8f0a946efd3d8c9b8aa6d68ee.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\821bbfc8f0a946efd3d8c9b8aa6d68ee.exe"C:\Users\Admin\AppData\Local\Temp\821bbfc8f0a946efd3d8c9b8aa6d68ee.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵