Find similar analyses in TI Lookup

Analysis date (UTC): 7 May 2020, 08:53Analysis environment: Windows 7 Pro, build 7601, x86

http://adamtcarruthers.com/sb/js/jiz.exe

MD5:072395700B50018C8FAEDCB237EA53A8

SHA1:629D3EDB345799576F72E95D53DE4B63F6A37148

SHA256:A44A479E9635F6DD36C58F37E2BB364E9B7698A2B089624AE995D2256EE63AE7

Analysis result

Threat level:Malicious activity

Tags:

ratagenttesla

Full analysis:Analysis http://adamtcarruthers.com/sb/js/jiz.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

jiz.exe (PID: 3208)

AGENTTESLA was detected

jiz.exe (PID: 3208)

Actions looks like stealing of personal data

jiz.exe (PID: 3208)

SUSPICIOUS

Executable content was dropped or overwritten

iexplore.exe (PID: 1640)
iexplore.exe (PID: 440)

Uses NETSH.EXE for network configuration

jiz.exe (PID: 3208)

INFO

Reads Internet Cache Settings

iexplore.exe (PID: 440)
iexplore.exe (PID: 1640)

Changes internet zones settings

iexplore.exe (PID: 440)

Dropped object may contain Bitcoin addresses

iexplore.exe (PID: 440)

Modifies the phishing filter of IE

iexplore.exe (PID: 440)

Creates files in the user directory

iexplore.exe (PID: 440)

Reads settings of System Certificates

iexplore.exe (PID: 440)

Adds / modifies Windows certificates

iexplore.exe (PID: 440)

Changes settings of System certificates

iexplore.exe (PID: 440)

Threats

PID	Process	Class	Message
1640	iexplore.exe	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1640	iexplore.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3208	jiz.exe	Generic Protocol Command Decode	SURICATA Applayer Detect protocol only one direction
3208	jiz.exe	A Network Trojan was detected	SPYWARE [PTsecurity] AgentTesla Exfiltration