ff13b14ea7b2ed3ed6636032acde2d78433a00b2085ff7336d712652eff91690

Analysis

max time kernel
20s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07-08-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JM Soloutions Loader.exe
Size

1.4MB
MD5

0519633b8f1802eff3dc187773029c86
SHA1

930a8606e62f5515c9bbbf5475eef32c389198f6
SHA256

ff13b14ea7b2ed3ed6636032acde2d78433a00b2085ff7336d712652eff91690
SHA512

329bd16d8047766d2bcc7a800bb927b0ecdba9cc77337dfa9309a31d1cfaf0a21d23bf4f23c840102f7c7e523baeef11334b7514b3d618f82b49f8e79cfdd83b
SSDEEP

24576:x0JWUEZVUuplg+awqwUwExIPfA8OLhJ9yp/xCcTOuIrmkSkkkkkjOWnJerC:x0JWUWh/qNwffAj3g/bTqSk6Wno

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3968	JM Soloutions Loader.exe
5956	JM Soloutions Loader.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3968	JM Soloutions Loader.exe
3968	JM Soloutions Loader.exe
5956	JM Soloutions Loader.exe
5956	JM Soloutions Loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2260	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4916	3968	JM Soloutions Loader.exe	81
PID 3968 wrote to memory of 4916	3968	JM Soloutions Loader.exe	81
PID 3968 wrote to memory of 5956	3968	JM Soloutions Loader.exe	85
PID 3968 wrote to memory of 5956	3968	JM Soloutions Loader.exe	85
PID 5956 wrote to memory of 2140	5956	JM Soloutions Loader.exe	86
PID 5956 wrote to memory of 2140	5956	JM Soloutions Loader.exe	86

C:\Users\Admin\AppData\Local\Temp\JM Soloutions Loader.exe
"C:\Users\Admin\AppData\Local\Temp\JM Soloutions Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\JM Soloutions Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\JM Soloutions Loader.exe" 3968
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2140

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
1KB

MD5
6df529b93b74c218cf1bd7e6db3d80c8

SHA1
cd9812045a3ff5f3d9e22f65b7524cbff3b832e8

SHA256
5aae377b617b1e9fa633af97e4be1d83489f5df8577df431dd27bc9a26fad253

SHA512
56b9868c103d13dc65dd57daef74db95cef2b3364242c0c6d057ccf0801516458cd660e3ace42bc860fab2cbb7cd62bd6a7d6087c91092916b998c1f17083c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
393ef5dd28737f58276a80091a71e89a

SHA1
74d5312394453fe28f4ebcd7421385d39cf964d4

SHA256
88d5421dc07885b0a0d9dba764bd012f98fb055fa7f81a013a03fa3b50f25081

SHA512
45f97103f1afc013506f33eae86cc44c9d7387022a2b063acaa52af86cee93c6915527626b257d5dc3f69f71a1a258935bcfc5dce8aaa41c1a89c5ec33e0aed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
8b3b0eee75e8349eb8bae1a5a44fab8c

SHA1
1e2c680159cecac0d8f0ea792de2a6baf1986eaa

SHA256
d10340e7a13b7fb66706939755e0a73dc1592ba5df19a6337ade4bc22a8cc07e

SHA512
804b777efd2821b9a8ddf6c9b0164ef01047403abd98c711b38531b60e3a8441bbdcd25de37ed1f5ebfcd32c946af3deec9e38878277d218876d78049d2e5c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_D7B2A7EA57402CF9609644C10FDC55CA

Filesize
471B

MD5
8fc53426bc26ab1a5404da15f4f50ff6

SHA1
8ad1c6a92d086f53652146b793cea0178febe726

SHA256
87a35b2a4e5af99ef3872bce17eb1bd4f5f9896518721200a7e35519e88e7b66

SHA512
772f4ca1a8b9fbcd169c6a63e86b95a244b5f5bd5009c2f558f5448be4bafe2d5d3cbf1aaa8ba00312ec2431ca777dd6bd7d3a302e734414ead7c5f47acd8113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
434B

MD5
1578f2c62cb8dec00a05a51bfde1d565

SHA1
859d0a56e5f0eb3ec2ac96ec2fcc6f72c4606929

SHA256
69213fe3609df84f11984689243a340b1a05acc48fe6c2af0a33d678df11707e

SHA512
f30e285988e1dde6888a2485a0d7cdaf572526088fc9ea5fc970820d707be5afa32be81f5734ea4fca5d56b256de591da12308c8378bf79c640fb36b2f6d2c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
393247930f7b5187ea6e9f21b138e341

SHA1
2dd0c1e53d5f76b0e49568300b38d8f56bf4b84b

SHA256
dfc7df06f92c8be8ecd8f23a837e71512104f80df373906090df196532969e2e

SHA512
dc04fa9f569225f90358dc90aa7ef782cb8033890e031617f7e8878df19bddc46a36215e03693d448795af56b028dfd733049273743486cd9a86dbd004714120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
8956f5cd1c99e75f4398f619805d0a4b

SHA1
bce84deaa88d55791df14f99a4d5671ae9246744

SHA256
3e836983b848d2f6b2b4d982d2ee89c6ec3d2e2aff7df5a097d8811d27b3c170

SHA512
1cf28edfde2c3401cc00e48f5f2ed818dd938a0f5460133a9bc726d5ecf2dbbd3725dda22d4a29c06119c4554c4b24a70b04bc65c3fcdaa7f90e7ef183338f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_D7B2A7EA57402CF9609644C10FDC55CA

Filesize
426B

MD5
ed2a21bbef62a08e30916345a5168837

SHA1
510f71e7ba57bf0250b27b615d360d7c510c4f44

SHA256
42eefcf4fa126991f1b6dd9816b377f81a709ff6a8287b2406a5b0a9aebf72a3

SHA512
5e7d311243a94056dfe6e95b20c26c9ede1336d68d5cd2639e4a0e150db7487dd76087c00bc28f1ac4049d27760bb2a8c6543ac35a88b4dbd1c49ba1accdb5f0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
27152171537c47796aa7194ac41383bc

SHA1
430c380ea885fce765a771cc40cbfe6358b4d04c

SHA256
28276ad4adb3f540918a28a722f10a63406037b96a14e05565e31ec90c605c22

SHA512
044ded8d45d2249f69ae617768398a33cf060618f1cb583aa9d9a34171de10bf3e23f6e49b3c0b8ca872f5ecbe98e841168fb3e94fdef2efbb299a3cbc01f616

Download Submit