146dac6959a30440d6e5550f5c01b792bf1395ea546a7586731da3fe9fd5fe29

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe
Size

10.0MB
MD5

4a85310630360dac8146dda3cbeeb9a0
SHA1

86420ece8ded3a374552bda67d1886e7135b9af2
SHA256

146dac6959a30440d6e5550f5c01b792bf1395ea546a7586731da3fe9fd5fe29
SHA512

f4ea439f3fdbb80bc3ce11d3cece27473d39ed4dd97448f653bcb9bf10dbb98eb70040a80fe9d52ab9d9dd5d744789341010abd8a4ba81b4ecd473d276abf61f
SSDEEP

196608:BPQPbQNMQ6KLCiwg6r+whTY0hw6FZrMW2ztoXkzVAaDsEnfEp:mPUNMQ/CBg6r9i0hw0uttCkRFQ/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Software\Microsoft\Internet Explorer\Main	NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2044	NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe
2044	NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4a85310630360dac8146dda3cbeeb9a0_JC.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download