1f9a3643587dc9abbb6418f0d8c88052a543060dadb8c3002f81fc42e2f94b89

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.01f5b14572094a3ac0505bcc9d463240_JC.exe
Size

260KB
MD5

01f5b14572094a3ac0505bcc9d463240
SHA1

4070117546d240b492c18c85c6a6b65365732d62
SHA256

1f9a3643587dc9abbb6418f0d8c88052a543060dadb8c3002f81fc42e2f94b89
SHA512

df52f971cfba5d06d5cd29c6f17a71fc35c16f2b9a7af5583bfa95c4543c9951599e40f1183571ad0e00c78c42bcd3b6eea5d3442840e8d13e0a4d81ab527706
SSDEEP

6144:Obmbj0LPGkvGVP7B22H9kDMrdtzLjOYfhiNGb/bMkK/:JPCuD5yDMrddxfQNwfI

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2656	znwkgzk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\cskihnk.dll	znwkgzk.exe
File created	C:\PROGRA~3\Mozilla\znwkgzk.exe	NEAS.01f5b14572094a3ac0505bcc9d463240_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2656	2324	taskeng.exe	29
PID 2324 wrote to memory of 2656	2324	taskeng.exe	29
PID 2324 wrote to memory of 2656	2324	taskeng.exe	29
PID 2324 wrote to memory of 2656	2324	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.01f5b14572094a3ac0505bcc9d463240_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.01f5b14572094a3ac0505bcc9d463240_JC.exe"
1⤵
- Drops file in Program Files directory
PID:1572

C:\Windows\system32\taskeng.exe
taskeng.exe {9111CF74-39EF-4FB3-A18C-8496068D820D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\PROGRA~3\Mozilla\znwkgzk.exe
  C:\PROGRA~3\Mozilla\znwkgzk.exe -nfwatvg
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znwkgzk.exe

Filesize
260KB

MD5
af49a465f201f7d587ac93f33f7f3efc

SHA1
1bab3dcc340f3d209a55a4dc106702553a090b48

SHA256
85b47130fdd8efec8a1e98d4a263f62d581f2b94f6de365cb0a198c517a891a0

SHA512
cd173c39727fd2b592c66761d0530be25bae224b1e85f4bbad229c1a2818b622b4ec150a1f32e406add257d432900db1e969722af1edcc14b85c8a2e3a7e1353

Download Submit
C:\PROGRA~3\Mozilla\znwkgzk.exe

Filesize
260KB

MD5
af49a465f201f7d587ac93f33f7f3efc

SHA1
1bab3dcc340f3d209a55a4dc106702553a090b48

SHA256
85b47130fdd8efec8a1e98d4a263f62d581f2b94f6de365cb0a198c517a891a0

SHA512
cd173c39727fd2b592c66761d0530be25bae224b1e85f4bbad229c1a2818b622b4ec150a1f32e406add257d432900db1e969722af1edcc14b85c8a2e3a7e1353

Download Submit
memory/1572-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1572-1-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/1572-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2656-12-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/2656-18-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download