Analysis
-
max time kernel
162s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10/10/2023, 19:05
General
-
Target
NEAS.0725711c51b2cc803034687d063fe940_JC.exe
-
Size
135KB
-
MD5
0725711c51b2cc803034687d063fe940
-
SHA1
bfa7b5c017dba6ad1bd3bf5e2e1b398d944a2194
-
SHA256
cd79608321a1becdcc82fe211bde93beaa23a30a25caf2891735321c4cd00842
-
SHA512
f92ed477df6ced9fd3705fb71bfa2a49e382bbebd9025207a4bde416f8c2eacc720f144cf472c4857a388c215835a842695f024c64badd5082b149f37f77a4d9
-
SSDEEP
1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg5hs3wwwwwwwwwwa:XVqoCl/YgjxEufVU0TbTyDDalTG
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0725711c51b2cc803034687d063fe940_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0725711c51b2cc803034687d063fe940_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD59304453c5be40e0edbe612c3ba2b512d
SHA10d14c6051532913ce9fa6f5e6c7dc06ae3c6634d
SHA256a9b336a68271e69d9b55776f998dd6eb84c8875caec7e6400ce73b595f311ec9
SHA512fbfc438a93f9dfafff2537be0222f3d3ef44c43bec8811f8128a7adebd667c807dde995b973043771f27f9a7f75d9a9f9142e2eea7a7a23a3c23e7062889d98a
-
Filesize
135KB
MD5ed50ea7b2f4e598dc63ebcb4547bd4cc
SHA1df54383f7820bebb00b653129429fd3be0063694
SHA256ceaa7bd4026cd2ef625050e22d78cd0bcce56728e77fe198f5ef102e2984fa6b
SHA512b983103033c01c35886a9eb11dd6917afb67e4c40f8234b3ce7c168d631da0541c52153adbbc870edd6bd76f1ab98b2db50faeb3ad4c5478ceab44c8dce1206f
-
Filesize
135KB
MD5ed50ea7b2f4e598dc63ebcb4547bd4cc
SHA1df54383f7820bebb00b653129429fd3be0063694
SHA256ceaa7bd4026cd2ef625050e22d78cd0bcce56728e77fe198f5ef102e2984fa6b
SHA512b983103033c01c35886a9eb11dd6917afb67e4c40f8234b3ce7c168d631da0541c52153adbbc870edd6bd76f1ab98b2db50faeb3ad4c5478ceab44c8dce1206f
-
Filesize
135KB
MD5ed50ea7b2f4e598dc63ebcb4547bd4cc
SHA1df54383f7820bebb00b653129429fd3be0063694
SHA256ceaa7bd4026cd2ef625050e22d78cd0bcce56728e77fe198f5ef102e2984fa6b
SHA512b983103033c01c35886a9eb11dd6917afb67e4c40f8234b3ce7c168d631da0541c52153adbbc870edd6bd76f1ab98b2db50faeb3ad4c5478ceab44c8dce1206f
-
Filesize
135KB
MD5e54c7d3a9079caafadd48eaec290f8e4
SHA168c838a9e77a7f1dfb85a704215a6c88bb950b61
SHA25685f91acf099e3b0a21b5adcf25f8bb107bb16418c1f2bbe7a157b351c9ee4e78
SHA51293febc2348f3f1ce124256a37551bef446deccb81c49374f83e497e92e342b6822b72fb77bc3a274fa4cdb5b99a6a67cfa0e6cfc788a3f87cf2899eb84dcee9f
-
Filesize
135KB
MD5ed50ea7b2f4e598dc63ebcb4547bd4cc
SHA1df54383f7820bebb00b653129429fd3be0063694
SHA256ceaa7bd4026cd2ef625050e22d78cd0bcce56728e77fe198f5ef102e2984fa6b
SHA512b983103033c01c35886a9eb11dd6917afb67e4c40f8234b3ce7c168d631da0541c52153adbbc870edd6bd76f1ab98b2db50faeb3ad4c5478ceab44c8dce1206f
-
Filesize
135KB
MD5e54c7d3a9079caafadd48eaec290f8e4
SHA168c838a9e77a7f1dfb85a704215a6c88bb950b61
SHA25685f91acf099e3b0a21b5adcf25f8bb107bb16418c1f2bbe7a157b351c9ee4e78
SHA51293febc2348f3f1ce124256a37551bef446deccb81c49374f83e497e92e342b6822b72fb77bc3a274fa4cdb5b99a6a67cfa0e6cfc788a3f87cf2899eb84dcee9f
-
Filesize
135KB
MD59304453c5be40e0edbe612c3ba2b512d
SHA10d14c6051532913ce9fa6f5e6c7dc06ae3c6634d
SHA256a9b336a68271e69d9b55776f998dd6eb84c8875caec7e6400ce73b595f311ec9
SHA512fbfc438a93f9dfafff2537be0222f3d3ef44c43bec8811f8128a7adebd667c807dde995b973043771f27f9a7f75d9a9f9142e2eea7a7a23a3c23e7062889d98a
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB