134ab10f5c16c46f9290d2c031a9d83adef5f36d7c82f7472778f479669ffaf5

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe
Size

1011KB
MD5

10fe0545906e5b7fe5d8957d8490a590
SHA1

2160a46256e5c42a841119536404e0c902ab40de
SHA256

134ab10f5c16c46f9290d2c031a9d83adef5f36d7c82f7472778f479669ffaf5
SHA512

edc56c298a6924c5ccaf97a4609d823c196299bd6d3c1370fdfe649c34363ca917802d1c51cdbcef50b3f47d4844c87cdf42078e98ba38e6e70f875d75873209
SSDEEP

24576:jiur4LUgziur4LUgziur4LUgziur4LUgziur4LUg+iur4LUgx:jbrZObrZObrZObrZObrZHbrZE

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2692	WMIC.exe
Token: SeSecurityPrivilege	2692	WMIC.exe
Token: SeTakeOwnershipPrivilege	2692	WMIC.exe
Token: SeLoadDriverPrivilege	2692	WMIC.exe
Token: SeSystemProfilePrivilege	2692	WMIC.exe
Token: SeSystemtimePrivilege	2692	WMIC.exe
Token: SeProfSingleProcessPrivilege	2692	WMIC.exe
Token: SeIncBasePriorityPrivilege	2692	WMIC.exe
Token: SeCreatePagefilePrivilege	2692	WMIC.exe
Token: SeBackupPrivilege	2692	WMIC.exe
Token: SeRestorePrivilege	2692	WMIC.exe
Token: SeShutdownPrivilege	2692	WMIC.exe
Token: SeDebugPrivilege	2692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2692	WMIC.exe
Token: SeRemoteShutdownPrivilege	2692	WMIC.exe
Token: SeUndockPrivilege	2692	WMIC.exe
Token: SeManageVolumePrivilege	2692	WMIC.exe
Token: 33	2692	WMIC.exe
Token: 34	2692	WMIC.exe
Token: 35	2692	WMIC.exe
Token: 36	2692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2692	WMIC.exe
Token: SeSecurityPrivilege	2692	WMIC.exe
Token: SeTakeOwnershipPrivilege	2692	WMIC.exe
Token: SeLoadDriverPrivilege	2692	WMIC.exe
Token: SeSystemProfilePrivilege	2692	WMIC.exe
Token: SeSystemtimePrivilege	2692	WMIC.exe
Token: SeProfSingleProcessPrivilege	2692	WMIC.exe
Token: SeIncBasePriorityPrivilege	2692	WMIC.exe
Token: SeCreatePagefilePrivilege	2692	WMIC.exe
Token: SeBackupPrivilege	2692	WMIC.exe
Token: SeRestorePrivilege	2692	WMIC.exe
Token: SeShutdownPrivilege	2692	WMIC.exe
Token: SeDebugPrivilege	2692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2692	WMIC.exe
Token: SeRemoteShutdownPrivilege	2692	WMIC.exe
Token: SeUndockPrivilege	2692	WMIC.exe
Token: SeManageVolumePrivilege	2692	WMIC.exe
Token: 33	2692	WMIC.exe
Token: 34	2692	WMIC.exe
Token: 35	2692	WMIC.exe
Token: 36	2692	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4196	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	88
PID 5112 wrote to memory of 4196	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	88
PID 4196 wrote to memory of 2692	4196	cmd.exe	90
PID 4196 wrote to memory of 2692	4196	cmd.exe	90
PID 5112 wrote to memory of 2232	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	93
PID 5112 wrote to memory of 2232	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	93
PID 5112 wrote to memory of 4420	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	95
PID 5112 wrote to memory of 4420	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	95
PID 4420 wrote to memory of 3472	4420	cmd.exe	97
PID 4420 wrote to memory of 3472	4420	cmd.exe	97
PID 4420 wrote to memory of 916	4420	cmd.exe	98
PID 4420 wrote to memory of 916	4420	cmd.exe	98
PID 5112 wrote to memory of 4072	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	101
PID 5112 wrote to memory of 4072	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	101
PID 4072 wrote to memory of 1824	4072	cmd.exe	104
PID 4072 wrote to memory of 1824	4072	cmd.exe	104
PID 4072 wrote to memory of 4248	4072	cmd.exe	105
PID 4072 wrote to memory of 4248	4072	cmd.exe	105
PID 5112 wrote to memory of 3940	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	107
PID 5112 wrote to memory of 3940	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	107
PID 3940 wrote to memory of 632	3940	cmd.exe	108
PID 3940 wrote to memory of 632	3940	cmd.exe	108
PID 3940 wrote to memory of 2464	3940	cmd.exe	109
PID 3940 wrote to memory of 2464	3940	cmd.exe	109
PID 5112 wrote to memory of 2564	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	110
PID 5112 wrote to memory of 2564	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	110
PID 2564 wrote to memory of 4988	2564	cmd.exe	112
PID 2564 wrote to memory of 4988	2564	cmd.exe	112
PID 2564 wrote to memory of 3804	2564	cmd.exe	113
PID 2564 wrote to memory of 3804	2564	cmd.exe	113
PID 5112 wrote to memory of 4968	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	114
PID 5112 wrote to memory of 4968	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	114
PID 4968 wrote to memory of 4536	4968	cmd.exe	116
PID 4968 wrote to memory of 4536	4968	cmd.exe	116
PID 4968 wrote to memory of 4276	4968	cmd.exe	117
PID 4968 wrote to memory of 4276	4968	cmd.exe	117
PID 5112 wrote to memory of 1048	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	119
PID 5112 wrote to memory of 1048	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	119
PID 1048 wrote to memory of 5028	1048	cmd.exe	120
PID 1048 wrote to memory of 5028	1048	cmd.exe	120
PID 1048 wrote to memory of 3064	1048	cmd.exe	121
PID 1048 wrote to memory of 3064	1048	cmd.exe	121
PID 5112 wrote to memory of 1624	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	123
PID 5112 wrote to memory of 1624	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	123
PID 1624 wrote to memory of 3324	1624	cmd.exe	124
PID 1624 wrote to memory of 3324	1624	cmd.exe	124
PID 1624 wrote to memory of 3100	1624	cmd.exe	125
PID 1624 wrote to memory of 3100	1624	cmd.exe	125
PID 5112 wrote to memory of 4104	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	126
PID 5112 wrote to memory of 4104	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	126
PID 4104 wrote to memory of 2924	4104	cmd.exe	128
PID 4104 wrote to memory of 2924	4104	cmd.exe	128
PID 4104 wrote to memory of 3584	4104	cmd.exe	129
PID 4104 wrote to memory of 3584	4104	cmd.exe	129
PID 5112 wrote to memory of 3896	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	130
PID 5112 wrote to memory of 3896	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	130
PID 3896 wrote to memory of 1940	3896	cmd.exe	133
PID 3896 wrote to memory of 1940	3896	cmd.exe	133
PID 3896 wrote to memory of 2912	3896	cmd.exe	132
PID 3896 wrote to memory of 2912	3896	cmd.exe	132
PID 5112 wrote to memory of 1716	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	134
PID 5112 wrote to memory of 1716	5112	NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe	134
PID 1716 wrote to memory of 1256	1716	cmd.exe	136
PID 1716 wrote to memory of 1256	1716	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.10fe0545906e5b7fe5d8957d8490a590_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C wmic bios get serialnumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C echo %computername%
  2⤵
  PID:2232
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C getmac /fo list | Find "Physical Address"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\getmac.exe
    getmac /fo list
    3⤵
    PID:3472
- - C:\Windows\system32\find.exe
    Find "Physical Address"
    3⤵
    PID:916
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\Users\Public\Desktop | find "AX_PROD"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\Users\Public\Desktop "
    3⤵
    PID:1824
- - C:\Windows\system32\find.exe
    find "AX_PROD"
    3⤵
    PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\Users\Public\Desktop | find "Retail POS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\Users\Public\Desktop "
    3⤵
    PID:632
- - C:\Windows\system32\find.exe
    find "Retail POS"
    3⤵
    PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\Users\axdcr\Desktop | find "AX_PROD"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\Users\axdcr\Desktop "
    3⤵
    PID:4988
- - C:\Windows\system32\find.exe
    find "AX_PROD"
    3⤵
    PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\Users\axdcr\Desktop | find "Retail POS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\Users\axdcr\Desktop "
    3⤵
    PID:4536
- - C:\Windows\system32\find.exe
    find "Retail POS"
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files (x86)"\HPGFulltaxVRF | find "HPGFulltaxVRF"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files (x86)"\HPGFulltaxVRF "
    3⤵
    PID:5028
- - C:\Windows\system32\find.exe
    find "HPGFulltaxVRF"
    3⤵
    PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files"\HPGFulltaxVRF | find "HPGFulltaxVRF"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files"\HPGFulltaxVRF "
    3⤵
    PID:3324
- - C:\Windows\system32\find.exe
    find "HPGFulltaxVRF"
    3⤵
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files (x86)"\"uvnc bvba"\UltraVNC | find "winvnc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files (x86)"\"uvnc bvba"\UltraVNC "
    3⤵
    PID:2924
- - C:\Windows\system32\find.exe
    find "winvnc"
    3⤵
    PID:3584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files"\"uvnc bvba"\UltraVNC | find "winvnc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\find.exe
    find "winvnc"
    3⤵
    PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files"\"uvnc bvba"\UltraVNC "
    3⤵
    PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files (x86)"\Websense\"Websense Endpoint" | find "F1EUI"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files (x86)"\Websense\"Websense Endpoint" "
    3⤵
    PID:1256
- - C:\Windows\system32\find.exe
    find "F1EUI"
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files"\Websense\"Websense Endpoint" | find "F1EUI"
  2⤵
  PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files"\Websense\"Websense Endpoint" "
    3⤵
    PID:4476
- - C:\Windows\system32\find.exe
    find "F1EUI"
    3⤵
    PID:4040
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files (x86)"\CrowdStrike | find "CSFalconService.exe"
  2⤵
  PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files (x86)"\CrowdStrike "
    3⤵
    PID:4760
- - C:\Windows\system32\find.exe
    find "CSFalconService.exe"
    3⤵
    PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C dir /b C:\"Program Files"\CrowdStrike | find "CSFalconService.exe"
  2⤵
  PID:1008
- - C:\Windows\system32\find.exe
    find "CSFalconService.exe"
    3⤵
    PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b C:\"Program Files"\CrowdStrike "
    3⤵
    PID:3112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-0-0x00000000009B0000-0x0000000000AB2000-memory.dmp

Filesize
1.0MB

Download
memory/5112-1-0x00007FFE42AC0000-0x00007FFE43581000-memory.dmp

Filesize
10.8MB

Download
memory/5112-2-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download
memory/5112-3-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download
memory/5112-4-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download
memory/5112-5-0x00007FFE42AC0000-0x00007FFE43581000-memory.dmp

Filesize
10.8MB

Download
memory/5112-6-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download
memory/5112-7-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download
memory/5112-8-0x000000001B800000-0x000000001B810000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads