ba7396c80f6fa4351c1b12632f565de4dbfa7f3b76f20aa2ffade8283b9351d1

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.7cac9eb807e7bb965055ed869df55700.exe
Size

2.5MB
MD5

7cac9eb807e7bb965055ed869df55700
SHA1

2c23fa3ac22e682f43f845757420415b7fdff529
SHA256

ba7396c80f6fa4351c1b12632f565de4dbfa7f3b76f20aa2ffade8283b9351d1
SHA512

9e53d1a6c7ba44de65872c13157b8db2270bc5ab9b81f6f1bd5e0578037c4b79c1b24b19b255d2e3787b0011f6f52a7dd1faf4d3b51b33175e6aff7a02bfb489
SSDEEP

49152:Eb5k2L5shwvgdQUKpz5kEQXGiCmwBgBoMhVvqAAhBcoCsPTn29d7VPwxn:E6Sv28IlCRBcHy3coCsPN

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2536	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2284	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe
2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2536	2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe	28
PID 2516 wrote to memory of 2536	2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe	28
PID 2516 wrote to memory of 2536	2516	NEAS.7cac9eb807e7bb965055ed869df55700.exe	28
PID 2536 wrote to memory of 2284	2536	cmd.exe	30
PID 2536 wrote to memory of 2284	2536	cmd.exe	30
PID 2536 wrote to memory of 2284	2536	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.7cac9eb807e7bb965055ed869df55700.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7cac9eb807e7bb965055ed869df55700.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.7cac9eb807e7bb965055ed869df55700.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads