c3743de300bf7020758fd227d8c7083d56e2667da8bd355aab3bbb6f3c982fb4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

webjxc.exe
Size

357KB
MD5

2ddb397b170df5f8fe850a1d4b4a1c75
SHA1

341b518fad3c7cfeb677fb455c014ca01bd3b49f
SHA256

a9fb4d03c4cdb1c790a6205d90d7fc4605d523ad3491560f6d2e253e328460a5
SHA512

a1558e4bbe0beebe9ad93da308eb0c1db5496f2ec67f6a445dece3634d7e6a2e6e01737d66d558bd57810576a6a5e90f83252183e7494a803a2b934cb0857c20
SSDEEP

6144:vQlv0u1WGh3u6nqreQpgU/81ijjlc/zYhKw3Gldo:YlvXh3duhWU/81ijpc/zYz3a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	webjxc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2448	webjxc.exe
2448	webjxc.exe
2448	webjxc.exe

C:\Users\Admin\AppData\Local\Temp\webjxc.exe
"C:\Users\Admin\AppData\Local\Temp\webjxc.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xpplatinum.ini

Filesize
7KB

MD5
e915811432ca714a1d27f857f63501e5

SHA1
b1dd90a3b872e5b3be919e70dfaa476ea1eed02a

SHA256
449106935808691d58b42aaca17ecbbeaeeff547014e4cd9c711a9d11c2dcb41

SHA512
6ebede1fc3663a0c61975f3e51c9583564efe328f669cee062c1e37b83d657f318e09e50a916680ecf7dd9f5dce6eb1e54c4c973cff69656517d22b4c3ea7225

Download Submit
memory/2448-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2448-407-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2448-409-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download