Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
-
Size
224KB
-
MD5
12414cfe3aaf9d0957f3519ced587e49
-
SHA1
811e1a355db8089cae9bd70985478628a5f23491
-
SHA256
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf
-
SHA512
74c57ab86e1ef6a352a988b8ebfe8c75c84a37066010829e84a891495d870763df026e3bfc429661dc380ff440d3ef38e0c67f768a9c47221ff9f434465a217b
-
SSDEEP
3072:FUHQW1D0tQ9nLHbB9W+k9ZJgImCguOelGqk:FUD4QxL7B9W+2JgIPgql
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neealil.exe -
Executes dropped EXE 1 IoCs
pid Process 1696 neealil.exe -
Loads dropped DLL 2 IoCs
pid Process 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe -
Adds Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /c" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /i" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /v" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /s" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /b" neealil.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /m" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /a" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /o" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /f" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /j" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /g" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /e" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /y" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /k" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /p" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /w" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /q" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /l" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /n" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /r" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /u" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /h" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /z" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /g" d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /x" neealil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\neealil = "C:\\Users\\Admin\\neealil.exe /d" neealil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe 1696 neealil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 1696 neealil.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1696 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 27 PID 1048 wrote to memory of 1696 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 27 PID 1048 wrote to memory of 1696 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 27 PID 1048 wrote to memory of 1696 1048 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe"C:\Users\Admin\AppData\Local\Temp\d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\neealil.exe"C:\Users\Admin\neealil.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD532f080fe9fdc441e4b84e76dbd5d77d1
SHA1602b58b7de748b41aaa95d02ddda78687fc1173e
SHA2567258e70da1d8e91582e08fe64e5783b23419fa9a70259919aa917889def41c16
SHA51228f020f87aff12a2d36c0e754193f0faf8efca3e53aa5decb241666539baf0155b8a0bf9ef4eba9df68d69c118f06ff83b706589bf50366ef19916b45001a2b8
-
Filesize
224KB
MD532f080fe9fdc441e4b84e76dbd5d77d1
SHA1602b58b7de748b41aaa95d02ddda78687fc1173e
SHA2567258e70da1d8e91582e08fe64e5783b23419fa9a70259919aa917889def41c16
SHA51228f020f87aff12a2d36c0e754193f0faf8efca3e53aa5decb241666539baf0155b8a0bf9ef4eba9df68d69c118f06ff83b706589bf50366ef19916b45001a2b8
-
Filesize
224KB
MD532f080fe9fdc441e4b84e76dbd5d77d1
SHA1602b58b7de748b41aaa95d02ddda78687fc1173e
SHA2567258e70da1d8e91582e08fe64e5783b23419fa9a70259919aa917889def41c16
SHA51228f020f87aff12a2d36c0e754193f0faf8efca3e53aa5decb241666539baf0155b8a0bf9ef4eba9df68d69c118f06ff83b706589bf50366ef19916b45001a2b8
-
Filesize
224KB
MD532f080fe9fdc441e4b84e76dbd5d77d1
SHA1602b58b7de748b41aaa95d02ddda78687fc1173e
SHA2567258e70da1d8e91582e08fe64e5783b23419fa9a70259919aa917889def41c16
SHA51228f020f87aff12a2d36c0e754193f0faf8efca3e53aa5decb241666539baf0155b8a0bf9ef4eba9df68d69c118f06ff83b706589bf50366ef19916b45001a2b8