Analysis

  • max time kernel
    120s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2023, 23:57

General

  • Target

    NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe

  • Size

    40KB

  • MD5

    1d23b39878f2eb3d6ed918f1a904bba0

  • SHA1

    40dd14676f2f054ed87b499e128832142d0005f5

  • SHA256

    5fd778051642ee46a4b457668ae104ef4f06b7e9992326e28a1f8901c71b4fd7

  • SHA512

    8514aeabebd6b4fb10d0830aeaf1cd0586d43c6aaee6e9ea6a77f50a3a9d4cb194ddf2e63a817201136c68ae51e4a69ba418a846773e88a33e259e76adbbe622

  • SSDEEP

    768:VQJ3lhtykCei0SjggaTsN4+zqM9LR3TO9GZydalfuV3lVwz0Snbc:V2lhAvei0LSd1hR369GOaFufVwgqc

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C WMIC OS get Caption,OSArchitecture,Version /Format:table & WMIC BIOS Get Manufacturer,Name /Format:table & WMIC Baseboard Get Product,Manufacturer /Format:table & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table & WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table & WMIC Diskdrive Get Model,Size /Format:table & WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table & WMIC netuse get Name /Format:table
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC OS get Caption,OSArchitecture,Version /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC BIOS Get Manufacturer,Name /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC Baseboard Get Product,Manufacturer /Format:table
        3⤵
          PID:2784
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table
          3⤵
            PID:2536
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table
            3⤵
              PID:2988
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC Diskdrive Get Model,Size /Format:table
              3⤵
                PID:2428
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table
                3⤵
                  PID:2552
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC netuse get Name /Format:table
                  3⤵
                    PID:2212

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                4156bbbbd5b62e7769e9f65ee51a5f28

                SHA1

                97f7125523a83dad957b01744649392388163c65

                SHA256

                fffc10ba378c7de70ea05a92339b4939a0c90589473c7e5954c791cb3d552f2e

                SHA512

                7dd50e1b574c65448349febe866f47abf13178534dcf85ab6534ae56dafa11313e5adb3dc4feaf8badd70a9a77ff6334fa46d8ddd84332a275add2d9b3e30980

              • C:\Users\Admin\AppData\Local\Temp\CabA891.tmp

                Filesize

                61KB

                MD5

                f3441b8572aae8801c04f3060b550443

                SHA1

                4ef0a35436125d6821831ef36c28ffaf196cda15

                SHA256

                6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

                SHA512

                5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

              • C:\Users\Admin\AppData\Local\Temp\TarA910.tmp

                Filesize

                163KB

                MD5

                9441737383d21192400eca82fda910ec

                SHA1

                725e0d606a4fc9ba44aa8ffde65bed15e65367e4

                SHA256

                bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

                SHA512

                7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

              • memory/2316-0-0x00000000002F0000-0x0000000000300000-memory.dmp

                Filesize

                64KB

              • memory/2316-1-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                Filesize

                9.9MB

              • memory/2316-2-0x000000001A7A0000-0x000000001A820000-memory.dmp

                Filesize

                512KB

              • memory/2316-65-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                Filesize

                9.9MB

              • memory/2316-66-0x000000001A7A0000-0x000000001A820000-memory.dmp

                Filesize

                512KB