d215cf3550092e9833a3f540caca905b73460f9b0ea0f97637aea5301e9389f7 | Triage

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 22:24

Sharing

Report Analysis Logs

General

Target

$PROGRAMFILES/Windows Media Player/jcxb.exe
Size

12KB
MD5

cac39e1fc84fda5c1179404ea0e7de52
SHA1

8f5ece3b85495dc92c7004d36bf7daa56b3bb43b
SHA256

f457b697c1b74807da7f840a7a927bad817b03d9a19d9b211d3d2c7d5bb9e0cc
SHA512

5227f346bb9eb5a0fac15a700b247f73d7761adfc7190543dd0ac47b0a2882484af705ce03c1fe3da3e2489954e2dcf6add198d0cf6d54b5303a258e3d4a84a3
SSDEEP

384:iy5CBZYz3rDIs1jvEoIILAPBjFtwvcXC6ma3:iMgZQbMs1qIQFFNy6ma

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2328-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral9/memory/2328-2-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	jcxb.exe
Token: SeDebugPrivilege	2328	jcxb.exe

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Windows Media Player\jcxb.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Windows Media Player\jcxb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2328-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download