316d5e914001fd721d589058df468785ffe6cf2d756a32502eb9cd551e0fbe3a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 18:35

Target

NEAS.012765fd98dbc5d7b4d2a12e290ed0c0_JC.exe
Size

337KB
MD5

012765fd98dbc5d7b4d2a12e290ed0c0
SHA1

62c2cfb4d1030916850d27fa7bc09f8022c282b9
SHA256

316d5e914001fd721d589058df468785ffe6cf2d756a32502eb9cd551e0fbe3a
SHA512

6efa81f51a8a866f44a02ec920f70b34658e9f3a9de91408d2312050693e56bb9999ef093adf8530b1b85a662fe84f3327cd4e88952d2464ae5e5f44ffecd143
SSDEEP

1536:WAOXZIt6nkzGAnv+PBOtpJImif1NDWgcIiQAqy5/l0DY+fHxslzp/w8M7i6kTGD:qIJ5YEzM7i6fDUBMWNEiXhFgl42tY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	NEAS.012765fd98dbc5d7b4d2a12e290ed0c0_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.012765fd98dbc5d7b4d2a12e290ed0c0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.012765fd98dbc5d7b4d2a12e290ed0c0_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact