b8acb715480d78b1b1ecf2f3f232164031bfbd84075e1980ae9ac679e9d1c425

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Size

544KB
MD5

ca03af798b0bb7cb8c937dc3b6fd6b50
SHA1

df432360fffe62944cb7b38673868b99a3033812
SHA256

b8acb715480d78b1b1ecf2f3f232164031bfbd84075e1980ae9ac679e9d1c425
SHA512

aadb47e56515d048330f1decba996a336e9cd131b49838e4bca1d456e58da20581a82db4efb617eae1473ce22e24debeada9665258f360fc80cebb6b8036442b
SSDEEP

12288:TzaYmLz8Ss824+BPsEoKTBhIW+QTfOFCyA:6Ym38h8V+J1hIW+cOo

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Calc.Application	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Calc.Application\CLSID	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\ProgID\ = "Calc.Application"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASCA~1.EXE"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\ProgID	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\InprocHandler32	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\InprocHandler32\ = "ole32.dll"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\LocalServer32	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Calc.Application\ = "Calc.Application"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48B0C90D-5945-4B00-B8DC-E9CB31824731}\ = "Calc.Application"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Calc.Application\CLSID\ = "{48B0C90D-5945-4B00-B8DC-E9CB31824731}"	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1816	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
1816	NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ca03af798b0bb7cb8c937dc3b6fd6b50_JC.exe"
1⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1816-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1816-1-0x0000000000350000-0x0000000000352000-memory.dmp

Filesize
8KB

Download
memory/1816-6-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/1816-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads