897b1cd5ce5a85ef7176479da0bc7dd8e3733cb4de9df483c282998e921dd429

Analysis

max time kernel
124s
max time network
144s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
Size

193KB
MD5

04259593ef3ee6732a1a2bb08d27f6e0
SHA1

667af5bafdf9842087d103908ce86888b090b5bb
SHA256

897b1cd5ce5a85ef7176479da0bc7dd8e3733cb4de9df483c282998e921dd429
SHA512

23b6acea4acc1750e5ca0a894b48285f05142778733255b6f91be1cee9507356c366328b313f1f731139022a74121865b190f11663bb49e6554cb4de0b6f0e00
SSDEEP

3072:9+8rpm1XGmuWB/VguosCXSgzo2SvUsN4niYiQIBPT:9Rm1Gmr9klXSgzo6s+iKI9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 372	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	24
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 384	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	23
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 420	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	22
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 464	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	21
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 480	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	20
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 488	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	19
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 592	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	18
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 668	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	17
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 748	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	16
PID 2948 wrote to memory of 804	2948	NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe	15

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.04259593ef3ee6732a1a2bb08d27f6e0_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:592

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x0000000001000000-0x000000000103C000-memory.dmp

Filesize
240KB

Download
memory/2948-1-0x000000007715F000-0x0000000077160000-memory.dmp

Filesize
4KB

Download
memory/2948-2-0x0000000077160000-0x0000000077161000-memory.dmp

Filesize
4KB

Download
memory/2948-3-0x0000000001000000-0x000000000103C000-memory.dmp

Filesize
240KB

Download