f68f5c0311f0c08a39403e5e273f0e824c371445ec45d06bca49a21a5f26b58f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe
Size

136KB
MD5

fe97afb5d970016d1febcf3dad1c46f0
SHA1

a7f08bc144fa87ebdd7d3a2adcff1a2c4148b2d3
SHA256

f68f5c0311f0c08a39403e5e273f0e824c371445ec45d06bca49a21a5f26b58f
SHA512

f3c2a167536bcc9a3a3972577d60d0e818cdddc70e051561279e92afb3cc98abc3c82250b0a3be55839427553d327e8d7b9c044bbf41cf6756b775cd1c9b7bb5
SSDEEP

3072:56pQc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraSo:56p2sSxTrGvsFUejWyZr3hPswaH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2356	NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2452	2356	NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe	28
PID 2356 wrote to memory of 2452	2356	NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe	28
PID 2356 wrote to memory of 2452	2356	NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe	28
PID 2356 wrote to memory of 2452	2356	NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe	28
PID 2452 wrote to memory of 2272	2452	cmd.exe	30
PID 2452 wrote to memory of 2272	2452	cmd.exe	30
PID 2452 wrote to memory of 2272	2452	cmd.exe	30
PID 2452 wrote to memory of 2272	2452	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2272	attrib.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\ctw5DCB.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\NEAS.fe97afb5d970016d1febcf3dad1c46f0_JC.exe"
    3⤵
    - Views/modifies file attributes
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ctw5DCB.tmp.bat

Filesize
57B

MD5
dbd7544d7d495d9ac9fe05799e28f3b3

SHA1
ed1b1f8d6071048cd1e8391ff86555b535ab7a8b

SHA256
be52b86befa9b0203c31ad615243e27fb179aa22f3dd87e63c85fea6cb4b883a

SHA512
257f9c1f1d3f00c32cfe034e740939d5b8eb9fd78633843470a1270d2083662d0bce0221c172d21d41ecf187936315b64719c8eb86ccfe053531e4aec03d657a

Download Submit
C:\Users\Admin\AppData\Roaming\ctw5DCB.tmp.bat

Filesize
57B

MD5
dbd7544d7d495d9ac9fe05799e28f3b3

SHA1
ed1b1f8d6071048cd1e8391ff86555b535ab7a8b

SHA256
be52b86befa9b0203c31ad615243e27fb179aa22f3dd87e63c85fea6cb4b883a

SHA512
257f9c1f1d3f00c32cfe034e740939d5b8eb9fd78633843470a1270d2083662d0bce0221c172d21d41ecf187936315b64719c8eb86ccfe053531e4aec03d657a

Download Submit
memory/2356-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2356-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download