Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe
-
Size
392KB
-
MD5
1ee2af3355020c34cfcece57133c2540
-
SHA1
b7b6e1a9c7ffa73fdc0dafe2e16b62a8072658ed
-
SHA256
39e0a58e9ed6d41d68e02b58f8d568ce8652b3e2b3cc9a5499036e8db24e575b
-
SHA512
ddc2ca99d529d1c0311f4e18918fad43527fc4fb8ab2efc3af7395469bb74e96754a911abd7ba756ad1d3b43b92402df433d2857491043ef57902895e30dad4b
-
SSDEEP
6144:LfbnfJUgIqySw25d2TYLiiGQho4yifxAwomRKxHY6G:LtUYw25gELiixhoVipAwodFY6G
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\rav.ini NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 468 NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe 468 NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe 468 NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe 468 NEAS.1ee2af3355020c34cfcece57133c2540_JC.exe