248282ed13ccd163d470a8decd600bbb8c117bb3a8e0062ff7fd08eb2c71eea8

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe
Size

490KB
MD5

83133ac888b2ccfedcf0b621b02b6f50
SHA1

e027c39ae63f83d27a63a5d1fe6d5bd994206585
SHA256

248282ed13ccd163d470a8decd600bbb8c117bb3a8e0062ff7fd08eb2c71eea8
SHA512

82c83b7ca8b156d9b0b70259d4a9f8ff6b0cafe33a6bd881a120fc9d71f30b8c4b7b5eaf90b0bed8c4466a35a2230b6923d5fe4670210d5324f779e18f1c98be
SSDEEP

12288:FytbV3kSoXaLnTosl83iQod48bTg5tdKFAg1zy8vi:Eb5kSYaLTVl8Sp48bTg5tdKFAmNi

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3548	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
380	NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe
380	NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 816	380	NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe	86
PID 380 wrote to memory of 816	380	NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe	86
PID 816 wrote to memory of 3548	816	cmd.exe	88
PID 816 wrote to memory of 3548	816	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.83133ac888b2ccfedcf0b621b02b6f50_JC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...