Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31-10-2023 20:28
General
-
Target
NEAS.8b6d4f70bc06a41871672ae520b95060_JC.exe
-
Size
14KB
-
MD5
8b6d4f70bc06a41871672ae520b95060
-
SHA1
d34cb88792b683e14bb9042f8605a9b10dc89db8
-
SHA256
dcf340b76187286ffafdce503c240edbba81adc753084723acbd4613a9a77322
-
SHA512
7e7db6f535e27c2dbbf70286eac506fc906d38f0fbb9af8f33b16e60fba163de952a226e6f45d0e9ecd5a5317c9699e9eb466189e4f7161526f9a83b2cf2b926
-
SSDEEP
384:NLo8SM32l/l8K9gFGhSPexJtsxvDE045HgJeJeJeJe:NvT32ltLKGMeHix7A
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8b6d4f70bc06a41871672ae520b95060_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8b6d4f70bc06a41871672ae520b95060_JC.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD50159de5bcd76ba46d4b982d3dc196d4e
SHA12433a1ffe1f9bf6452e7b7a49a9d8b8345414711
SHA256f29ca57a9e05383f6ad88f3edadf490052a7f77f2e00079128ee141ec3744404
SHA512bd41e10d3a1289110b4f4e97e7e582500c2d032bd7de27eb4884dbbe12a1a9115138c047cf507896fc03b7f810f832ce15a3f1202a9291beb7e4405a0de275d6
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB