Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 16:32

General

  • Target

    NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe

  • Size

    392KB

  • MD5

    1ee2af3355020c34cfcece57133c2540

  • SHA1

    b7b6e1a9c7ffa73fdc0dafe2e16b62a8072658ed

  • SHA256

    39e0a58e9ed6d41d68e02b58f8d568ce8652b3e2b3cc9a5499036e8db24e575b

  • SHA512

    ddc2ca99d529d1c0311f4e18918fad43527fc4fb8ab2efc3af7395469bb74e96754a911abd7ba756ad1d3b43b92402df433d2857491043ef57902895e30dad4b

  • SSDEEP

    6144:LfbnfJUgIqySw25d2TYLiiGQho4yifxAwomRKxHY6G:LtUYw25gELiixhoVipAwodFY6G

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/468-0-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/468-18-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB