Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
23/10/2023, 16:25
General
-
Target
NEAS.19689489a3517a60b91cbc1409943bfb_JC.exe
-
Size
464KB
-
MD5
19689489a3517a60b91cbc1409943bfb
-
SHA1
d0557616b8887f6bc9d95e29bd20b7f148832005
-
SHA256
5c80f14f5886ff3b97411f3224a0621f819c43f32781e1e7b35f979962b4713f
-
SHA512
d0b8f28dfe9bf48593e0f1258fecc8a57e7d24b2827931bf72a9f206e573dc223cd0b7f935711287a3a08e4408c53c621c51a1e76b7be472854934d094edb2d0
-
SSDEEP
12288:jzlc87eqqV5e+wBV6O+pmBwmGYmDWgd5p7UBDjKNYBj+C:jzSqqHeVBxdwnYm9JuKq+C
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.19689489a3517a60b91cbc1409943bfb_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.19689489a3517a60b91cbc1409943bfb_JC.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MRINnet1\certnsvr.exe"C:\Users\Admin\AppData\Roaming\MRINnet1"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~8EC3.tmp3200 475144 3136 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\ieUnedit.exeC:\Windows\SysWOW64\ieUnedit.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD5d009c8f04fdddfeaa98e5a09bc4f093d
SHA10c60f12f69432859b1668ed1dbb58d40b6555e57
SHA2563e83124f2b2165b00679b2886e1c34244a18437b6f0e8436baed49ed266e8c34
SHA5122fc1ed339c454ecb26af82bcc5497b5a5678dbc7bf4a59b006d6a9539e72e153dbff4d83b3c541d0ddee0a898b3a8e26943f7865b0afb80441165b814799e853
-
Filesize
464KB
MD5d009c8f04fdddfeaa98e5a09bc4f093d
SHA10c60f12f69432859b1668ed1dbb58d40b6555e57
SHA2563e83124f2b2165b00679b2886e1c34244a18437b6f0e8436baed49ed266e8c34
SHA5122fc1ed339c454ecb26af82bcc5497b5a5678dbc7bf4a59b006d6a9539e72e153dbff4d83b3c541d0ddee0a898b3a8e26943f7865b0afb80441165b814799e853
-
Filesize
464KB
MD5d009c8f04fdddfeaa98e5a09bc4f093d
SHA10c60f12f69432859b1668ed1dbb58d40b6555e57
SHA2563e83124f2b2165b00679b2886e1c34244a18437b6f0e8436baed49ed266e8c34
SHA5122fc1ed339c454ecb26af82bcc5497b5a5678dbc7bf4a59b006d6a9539e72e153dbff4d83b3c541d0ddee0a898b3a8e26943f7865b0afb80441165b814799e853
-
Filesize
464KB
MD5d009c8f04fdddfeaa98e5a09bc4f093d
SHA10c60f12f69432859b1668ed1dbb58d40b6555e57
SHA2563e83124f2b2165b00679b2886e1c34244a18437b6f0e8436baed49ed266e8c34
SHA5122fc1ed339c454ecb26af82bcc5497b5a5678dbc7bf4a59b006d6a9539e72e153dbff4d83b3c541d0ddee0a898b3a8e26943f7865b0afb80441165b814799e853
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
20KB
-
Filesize
488KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
528KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
52KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
528KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
488KB