168b6f5290b4597c9906d53224cee5ddda5489c4f1062fd6bb94f9c31bf081c1

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe
Size

1.3MB
MD5

44f5bf12b9401bd846da987a5897c320
SHA1

14affd6bfd65cc42a5ba63fe3565b04c442befbd
SHA256

168b6f5290b4597c9906d53224cee5ddda5489c4f1062fd6bb94f9c31bf081c1
SHA512

54683940232e946451b3b22d5dca3f95f93f42521120903c1c7f982c04e72da47a37d5302de4fd0edc37f182b4a95fc4685680984841442e007def37dcb760c8
SSDEEP

24576:Z9ypVnBJhpRCSK1nwHI7njknrk+ctdTavxxaLIdJBV1Ls2wBP:Z9U2P14OIn4FT6xxaLsJBV1Ls2wB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe
Token: SeIncreaseQuotaPrivilege	4740	wmic.exe
Token: SeSecurityPrivilege	4740	wmic.exe
Token: SeTakeOwnershipPrivilege	4740	wmic.exe
Token: SeLoadDriverPrivilege	4740	wmic.exe
Token: SeSystemProfilePrivilege	4740	wmic.exe
Token: SeSystemtimePrivilege	4740	wmic.exe
Token: SeProfSingleProcessPrivilege	4740	wmic.exe
Token: SeIncBasePriorityPrivilege	4740	wmic.exe
Token: SeCreatePagefilePrivilege	4740	wmic.exe
Token: SeBackupPrivilege	4740	wmic.exe
Token: SeRestorePrivilege	4740	wmic.exe
Token: SeShutdownPrivilege	4740	wmic.exe
Token: SeDebugPrivilege	4740	wmic.exe
Token: SeSystemEnvironmentPrivilege	4740	wmic.exe
Token: SeRemoteShutdownPrivilege	4740	wmic.exe
Token: SeUndockPrivilege	4740	wmic.exe
Token: SeManageVolumePrivilege	4740	wmic.exe
Token: 33	4740	wmic.exe
Token: 34	4740	wmic.exe
Token: 35	4740	wmic.exe
Token: 36	4740	wmic.exe
Token: SeIncreaseQuotaPrivilege	4740	wmic.exe
Token: SeSecurityPrivilege	4740	wmic.exe
Token: SeTakeOwnershipPrivilege	4740	wmic.exe
Token: SeLoadDriverPrivilege	4740	wmic.exe
Token: SeSystemProfilePrivilege	4740	wmic.exe
Token: SeSystemtimePrivilege	4740	wmic.exe
Token: SeProfSingleProcessPrivilege	4740	wmic.exe
Token: SeIncBasePriorityPrivilege	4740	wmic.exe
Token: SeCreatePagefilePrivilege	4740	wmic.exe
Token: SeBackupPrivilege	4740	wmic.exe
Token: SeRestorePrivilege	4740	wmic.exe
Token: SeShutdownPrivilege	4740	wmic.exe
Token: SeDebugPrivilege	4740	wmic.exe
Token: SeSystemEnvironmentPrivilege	4740	wmic.exe
Token: SeRemoteShutdownPrivilege	4740	wmic.exe
Token: SeUndockPrivilege	4740	wmic.exe
Token: SeManageVolumePrivilege	4740	wmic.exe
Token: 33	4740	wmic.exe
Token: 34	4740	wmic.exe
Token: 35	4740	wmic.exe
Token: 36	4740	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe
4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4740	4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe	86
PID 4552 wrote to memory of 4740	4552	NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.44f5bf12b9401bd846da987a5897c320_JC.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Cheathappens\Debug\Dawn of War 3.debug

Filesize
435B

MD5
edf1b30380d67534a84b4cc11eee3634

SHA1
241b293a60499b6dc6d3cad94ec92b9495272a8c

SHA256
c517c333ca6eed5df2a1f49f54a2d36cd3bad42bfa00bbcfbf93179da5f5fd09

SHA512
decf53c1c9c5aef8be82499fa77c3e2d10ca803779716508d1b1bdb58117365e5e2e176333665fd30af3cae68f596d295f90a154a06f526846b5966887844c14

Download Submit