f0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912

Analysis

max time kernel
141s
max time network
158s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-10-2023 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe
Size

344KB
MD5

3e133f661b74e398c2906931e0e4156c
SHA1

6d98c3664f8a0e4bda116511579896ebc42f3aff
SHA256

f0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912
SHA512

a65358735c27f12844e82af76ec4eb0d11372c9f5a2007321bd53c30f554461075b5cdfc376bfb1dac7c91ab20e5d6f011448a9c4b5b79bfa0f4b280d377e1f2
SSDEEP

6144:Bv8hza/coPxII4AdFvkk1VTQ0upQnxk+uuL:NkG/coZIUyW

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe

description pid process

Token: SeDebugPrivilege 2068 NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe

description	pid	process
Token: SeDebugPrivilege	2068	NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASf0caaaebe92baa4bc450b54344dfbd8c9f6c4ee2057a6d289b2c347b8b7ae912exeexe_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000B30000-0x0000000000B8A000-memory.dmp

Filesize
360KB

Download
memory/2068-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-2-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download
memory/2068-3-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-4-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download