Analysis
-
max time kernel
203s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
05-11-2023 07:30
General
-
Target
NEAS.1a177e44ce0af6e9a0de20d7e8b854b0.exe
-
Size
171KB
-
MD5
1a177e44ce0af6e9a0de20d7e8b854b0
-
SHA1
e5dbcb6bc0c5c0bd4eaabc5c4e47743d8b015343
-
SHA256
b771f04baa0225541d0e377d07843b6cee0fbd67ba0917b5db424afeed4f901a
-
SHA512
dedb45de432a31178ad4098fcef00b81b13fedbeee4321cfae45c8da27e84051f48121b1b7bcc4419a7a6f051ec84598bf4b52137ac3e000aaf140694380d065
-
SSDEEP
3072:S2qTc8JsfA/rpTeieAp0jVMz52M7I2yOUXjbF3dz8mrvX54IE:SvTc8J0WpTedSz5dc2yOUTxFnrvX54/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1a177e44ce0af6e9a0de20d7e8b854b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1a177e44ce0af6e9a0de20d7e8b854b0.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {FBF9E662-F7D1-4564-91AB-542A266E6708} S-1-5-21-3425689832-2386927309-2650718742-1000:AWDHTXES\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~3\Mozilla\pwhehon.exeC:\PROGRA~3\Mozilla\pwhehon.exe -arzwbsb2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD5b56acd96fcf955573169c4e6283f3bf1
SHA1938f2fd5b97512329b0f7e49501c8c3c096991aa
SHA25689d14246ea11029d556104173431d95a626e20c5fb25685aa33d109070fbd59e
SHA512086bb26cbdaebe449ff4446b70c49edf615182708495282d523751a7db1507b9abcf17ed40912586c5bed6f4038ce73afcfbd78683707dd3fc0c38b201024b69
-
Filesize
171KB
MD5b56acd96fcf955573169c4e6283f3bf1
SHA1938f2fd5b97512329b0f7e49501c8c3c096991aa
SHA25689d14246ea11029d556104173431d95a626e20c5fb25685aa33d109070fbd59e
SHA512086bb26cbdaebe449ff4446b70c49edf615182708495282d523751a7db1507b9abcf17ed40912586c5bed6f4038ce73afcfbd78683707dd3fc0c38b201024b69
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB