b4ef2c05e5bda32c7ac5d7e2a6f2bcb9df4727c7dd44f8e86ee0e32f2a54a05f

Analysis

max time kernel
143s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
Size

58KB
MD5

b9d3a4cc85f9a26015fe4479d0812e49
SHA1

d34eb58d54d120c7243c882d54baa96e75e2b06a
SHA256

b4ef2c05e5bda32c7ac5d7e2a6f2bcb9df4727c7dd44f8e86ee0e32f2a54a05f
SHA512

cfd4630d71900487358df8d3f938cca5138db90a3dac1b02e4868e81308942b23dafd3d7826cccacbca836a45dd740534fd959087eb2f5367d59c559ba5d6f3d
SSDEEP

768:MDcpEBMLfQcubV5wGE96YyXDTLdNSSS583:MDcfLfIbtEbyXfZb

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1588	attrib.exe

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1692	zskhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\zskhost.exe	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	attrib.exe
File created	C:\Windows\Debug\zskhost.exe	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1588	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	28
PID 1288 wrote to memory of 1588	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	28
PID 1288 wrote to memory of 1588	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	28
PID 1288 wrote to memory of 1588	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	28
PID 1288 wrote to memory of 2724	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	31
PID 1288 wrote to memory of 2724	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	31
PID 1288 wrote to memory of 2724	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	31
PID 1288 wrote to memory of 2724	1288	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1588	attrib.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\zskhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\NEASB9~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2724

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\zskhost.exe

Filesize
58KB

MD5
02f841027c93a73547b65e7303a8c171

SHA1
9b66cdea4fdb096aa980e4290ca5bb295fb73f92

SHA256
449ce2e8e8cc379e50ac07e1f0e8a18b531328dc4902e8023a8bb489bd6852ed

SHA512
6ca6aad100605b5c6880102d0ba36a2adaf2763fe467188220289ca27632c6286a3db5f229499fb017950cebb4d8d7102c0246f16b3012833a158aed4bbca367

Download Submit
C:\Windows\debug\zskhost.exe

Filesize
58KB

MD5
02f841027c93a73547b65e7303a8c171

SHA1
9b66cdea4fdb096aa980e4290ca5bb295fb73f92

SHA256
449ce2e8e8cc379e50ac07e1f0e8a18b531328dc4902e8023a8bb489bd6852ed

SHA512
6ca6aad100605b5c6880102d0ba36a2adaf2763fe467188220289ca27632c6286a3db5f229499fb017950cebb4d8d7102c0246f16b3012833a158aed4bbca367

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads