Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
05-11-2023 03:21
General
-
Target
NEAS.3713465ce08212f6a1b0d303a3c9df30_JC.exe
-
Size
135KB
-
MD5
3713465ce08212f6a1b0d303a3c9df30
-
SHA1
239202d20329ffd607aad4e206a71763e0c5e7d9
-
SHA256
225e4c3742b05d7fdacb010e7389d0ab78c1bc8ecbd8c404b24869fdb759daf9
-
SHA512
4458b03761e21d2ae69727613217aa18ae97ceb51df2cd2b97334c42297d1855dc11cd559f8aa6cce2ab80727c2f8f90cfe0d0ff0e00f3acd5de0af9fc18ffee
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVHr0:UVqoCl/YgjxEufVU0TbTyDDalN0
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3713465ce08212f6a1b0d303a3c9df30_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3713465ce08212f6a1b0d303a3c9df30_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5c7896b87f0876058fe96408ad663026d
SHA1fc607c46d479e57be4e375f735cb7a49c7c05f9d
SHA2567eb5c44fce6a42653b65709b203e257294b7e31d62ea692fa10b4a5b8359fe8c
SHA512d9b161eacfa3e3f46df7b07a08c770289cbea36a7fa6be52d6be3d44b65c6ddbc39174135decc7c830d78a51816ec27be203a48925e3c3d18d49c42edbd19cf9
-
Filesize
135KB
MD50013fa4b44d7a06e2a2f53a1d52bbcf2
SHA1dfb74fa276ff422b73628fc29057d8651874f8f1
SHA256020b933fe897d45393b975dfb288e816fc0326647a07f7047a234690e39cc1e6
SHA5129bdf8eab75a097dedaa4a9946ea6cdd8fd944daea14125e83dab47a8dcc11aea267d3035305731e567813d33c572f586fabef48cac07539cd36e1ae8791072c4
-
Filesize
135KB
MD50013fa4b44d7a06e2a2f53a1d52bbcf2
SHA1dfb74fa276ff422b73628fc29057d8651874f8f1
SHA256020b933fe897d45393b975dfb288e816fc0326647a07f7047a234690e39cc1e6
SHA5129bdf8eab75a097dedaa4a9946ea6cdd8fd944daea14125e83dab47a8dcc11aea267d3035305731e567813d33c572f586fabef48cac07539cd36e1ae8791072c4
-
Filesize
135KB
MD50013fa4b44d7a06e2a2f53a1d52bbcf2
SHA1dfb74fa276ff422b73628fc29057d8651874f8f1
SHA256020b933fe897d45393b975dfb288e816fc0326647a07f7047a234690e39cc1e6
SHA5129bdf8eab75a097dedaa4a9946ea6cdd8fd944daea14125e83dab47a8dcc11aea267d3035305731e567813d33c572f586fabef48cac07539cd36e1ae8791072c4
-
Filesize
135KB
MD565aff9236b094e4f560258560469fced
SHA1eebac26c73128f18061a0623322e88997c518b7e
SHA256c8782029f4e8fff976d2ec31ae5ff7389aaf8126ce8b0c575f38009f55a85566
SHA5126871199a092d397d39fbd1085e0e44986eaab5747a2699dc9284af7128b549a24312911c2325444f964ba0e6759c0281c49fc015486a1a10b24152cff1c3aad6
-
Filesize
135KB
MD50013fa4b44d7a06e2a2f53a1d52bbcf2
SHA1dfb74fa276ff422b73628fc29057d8651874f8f1
SHA256020b933fe897d45393b975dfb288e816fc0326647a07f7047a234690e39cc1e6
SHA5129bdf8eab75a097dedaa4a9946ea6cdd8fd944daea14125e83dab47a8dcc11aea267d3035305731e567813d33c572f586fabef48cac07539cd36e1ae8791072c4
-
Filesize
135KB
MD565aff9236b094e4f560258560469fced
SHA1eebac26c73128f18061a0623322e88997c518b7e
SHA256c8782029f4e8fff976d2ec31ae5ff7389aaf8126ce8b0c575f38009f55a85566
SHA5126871199a092d397d39fbd1085e0e44986eaab5747a2699dc9284af7128b549a24312911c2325444f964ba0e6759c0281c49fc015486a1a10b24152cff1c3aad6
-
Filesize
135KB
MD5c7896b87f0876058fe96408ad663026d
SHA1fc607c46d479e57be4e375f735cb7a49c7c05f9d
SHA2567eb5c44fce6a42653b65709b203e257294b7e31d62ea692fa10b4a5b8359fe8c
SHA512d9b161eacfa3e3f46df7b07a08c770289cbea36a7fa6be52d6be3d44b65c6ddbc39174135decc7c830d78a51816ec27be203a48925e3c3d18d49c42edbd19cf9
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB