10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 18:46

Target

10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
Size

448KB
MD5

1814e854a41c0516715ebe41cd07f578
SHA1

9c94737a55acc11c2fcf87f802a3178fe8c26c32
SHA256

10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df
SHA512

f82be39689832fe57903218380352395371acb65d6a2f7294683d259abbf53d1c26df7f26b07d2b000ad8ddbf8dc981c4b07a13fba07bb3d1c96dc4efde26b12
SSDEEP

6144:C+1747/a+K159Blpqp/vxOnphFivR93adhwLkW52ASkEjWbjcSbcY+CaQdaFOY4q:N547MG93adhnfkFbz+xt4vF

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3000	NXJITID.exe

Loads dropped DLL 2 IoCs

pid	Process
2944	cmd.exe
2944	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\NXJITID.exe	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
File opened for modification	C:\windows\SysWOW64\NXJITID.exe	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
File created	C:\windows\SysWOW64\NXJITID.exe.bat	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
3000	NXJITID.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe
3000	NXJITID.exe
3000	NXJITID.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2944	2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe	28
PID 2308 wrote to memory of 2944	2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe	28
PID 2308 wrote to memory of 2944	2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe	28
PID 2308 wrote to memory of 2944	2308	10b0759c671c5bd6e4dae62be9812c13f7cdd4d44e9e2ab1faa450492641b8df.exe	28
PID 2944 wrote to memory of 3000	2944	cmd.exe	30
PID 2944 wrote to memory of 3000	2944	cmd.exe	30
PID 2944 wrote to memory of 3000	2944	cmd.exe	30
PID 2944 wrote to memory of 3000	2944	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\NXJITID.exe.bat

Filesize
78B

MD5
3c4b569fa4f127aa86ddb7830fcd9280

SHA1
deff6571af03c70d7a205cbc498f67e6d13b15e7

SHA256
58cacd6022d84190c3ba58fe574abcd7a829c0ee670eb8d69ebba6aae7fe5c0c

SHA512
7a7aef85938714ff21bc077f0ed4b9017ee18ea9dcfb002c1ffd386b8b34b189c3fde905b5c38dcbe54b43eda0976be7b9564eeaa54dd7b320d04db7863595bf

Download Submit
\Windows\SysWOW64\NXJITID.exe

Filesize
448KB

MD5
307c5c5cc55c6c3ecb428eacde8ba158

SHA1
c03616b79054cda7b6ba526940d1ca8658c00c82

SHA256
c7f092c3d3507ccea3ddbf7ccd61c1869cb7a736a186be555290309a21f60764

SHA512
249a31b38d285c6dd210eed86c3a6a6e105e96f51da73edb5a4ceb391825c441ca7fa8d3d0b932846bfe74dd9fdd70b56bc0868cf755a9716c6c61fe05e432b4

Download Submit
memory/2308-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-18-0x0000000000430000-0x0000000000468000-memory.dmp

Filesize
224KB

Download
memory/2944-19-0x0000000000430000-0x0000000000468000-memory.dmp

Filesize
224KB

Download
memory/3000-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3000-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download