Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14/10/2023, 10:31
General
-
Target
NEAS.06984e3d54fb6818b436748229b5d040_JC.exe
-
Size
89KB
-
MD5
06984e3d54fb6818b436748229b5d040
-
SHA1
01353b4f51275e8c20ad158cb5acd4512a5de08a
-
SHA256
2ce01d2abf37e25bcec5334d26b89428249737753a8af514efae9e4b40650052
-
SHA512
dfb155e99da5371fba9dac4256ea0355547f77092190b64fe93d8092e35d65d021dc08e6897d8b9c9b0d9dbac8db29e38272e0a8b0cd63e123d3c57d45b657ef
-
SSDEEP
768:JgO5xRYi+SQvvG5bnl/NqNwsKVDsBYD77aXKynF0vq:eshQvoLqNwDDhCeq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Program crash 1 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.06984e3d54fb6818b436748229b5d040_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.06984e3d54fb6818b436748229b5d040_JC.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 15603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2052 -ip 20521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD56de2488e1d9b5ba16d3b21d02cba1df2
SHA1cda6847f282d72e55b7b3f354839c4ecc97f3f35
SHA25684f8f43775990516df20aaa48bd13644946e9ebca45404ebde8885337e9f7427
SHA512e69186b6023ddd41c8f211d59ef610519b69341c9d2bc417d9fa5d32f87d77d72afe340542cea36e182e0bac197ce30fbbdef9dedbff954b397e6d2f99509435
-
Filesize
89KB
MD52fd58b1c5a9e81d21c8bbeb956130e06
SHA1aa24b2839843a1bdfb75ae5d0f3854d3a8c2b8b2
SHA25646fdaf016c43824774b904605c3c52ac3e1382218c99b63ccd17176aa980b50b
SHA5120b3a4a009d2b15bf14e5a8343a03a45a8a0f599ccf5fb3891b4af41d16e1dc866065f634001bb950659124db1259f776894d8e26477ab7828db7c15b8f8822cf
-
Filesize
89KB
MD52fd58b1c5a9e81d21c8bbeb956130e06
SHA1aa24b2839843a1bdfb75ae5d0f3854d3a8c2b8b2
SHA25646fdaf016c43824774b904605c3c52ac3e1382218c99b63ccd17176aa980b50b
SHA5120b3a4a009d2b15bf14e5a8343a03a45a8a0f599ccf5fb3891b4af41d16e1dc866065f634001bb950659124db1259f776894d8e26477ab7828db7c15b8f8822cf
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB