Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
02-11-2023 21:41
General
-
Target
NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe
-
Size
484KB
-
MD5
6558f2354d65e18e6dd92848965ca440
-
SHA1
fb453c960ae29e23f0afff1f584639661fdbe4d5
-
SHA256
51591f35883b685ab8d4629614d39ef3d06a64b3ce44bbfab821ada9be29f8df
-
SHA512
fec62bc7444e18800bad5cff2e00aa60f5916a1c2b69112240cfd8ac6e8de8a5331b754ba1ae8d925dd0dd281b80bce8ce773c5c7bd30898e37942140139f4e2
-
SSDEEP
12288:yLPkCDt1EG2XVekhdeT1ZfTBmYjHYJH7PEzYa:yLPkQ1bqA91Td4JbPEx
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\pringini\calcexec.exe"C:\Users\Admin\AppData\Roaming\pringini"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~26DC.tmp3344 496136 408 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\charndue.exeC:\Windows\SysWOW64\charndue.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5104 -ip 51041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD562cf263503c10d4ce352f68a9ea82a61
SHA14d7246b996e17b8ada889c88253dd140a3924f9f
SHA256073e8fe8cad012ed4609b737c65cf3202f5f73616e084afd1bd6d90314813c96
SHA512d20bf18ccb159c8ef7876bdd06ea477ea5e70555e60096538182527285fd27fe70689c08885913852e0dc3f97dcd304a94aaea91a682f59429c0da05348aa82e
-
Filesize
484KB
MD562cf263503c10d4ce352f68a9ea82a61
SHA14d7246b996e17b8ada889c88253dd140a3924f9f
SHA256073e8fe8cad012ed4609b737c65cf3202f5f73616e084afd1bd6d90314813c96
SHA512d20bf18ccb159c8ef7876bdd06ea477ea5e70555e60096538182527285fd27fe70689c08885913852e0dc3f97dcd304a94aaea91a682f59429c0da05348aa82e
-
Filesize
484KB
MD562cf263503c10d4ce352f68a9ea82a61
SHA14d7246b996e17b8ada889c88253dd140a3924f9f
SHA256073e8fe8cad012ed4609b737c65cf3202f5f73616e084afd1bd6d90314813c96
SHA512d20bf18ccb159c8ef7876bdd06ea477ea5e70555e60096538182527285fd27fe70689c08885913852e0dc3f97dcd304a94aaea91a682f59429c0da05348aa82e
-
Filesize
484KB
MD562cf263503c10d4ce352f68a9ea82a61
SHA14d7246b996e17b8ada889c88253dd140a3924f9f
SHA256073e8fe8cad012ed4609b737c65cf3202f5f73616e084afd1bd6d90314813c96
SHA512d20bf18ccb159c8ef7876bdd06ea477ea5e70555e60096538182527285fd27fe70689c08885913852e0dc3f97dcd304a94aaea91a682f59429c0da05348aa82e
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
548KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
548KB
-
Filesize
524KB
-
Filesize
524KB