597d6fcc25692a52f7a0aa4300739bff76f289dd6e6087d2ed2d71ba0101a008

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Size

482KB
MD5

0ef20b3c05d8d17c57806b5e68456020
SHA1

b78d681f3884b6f34dd7759e89ab091084a66537
SHA256

597d6fcc25692a52f7a0aa4300739bff76f289dd6e6087d2ed2d71ba0101a008
SHA512

23e0d915f25ed6f2eabf77cfac373455ae2d102931b4bfe461646c4acbc2f4c327fd1908a8282f7f38938c892930fe03240eff10188296f9a39ac27d85f90097
SSDEEP

6144:2dspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70NqO:M8kxNhOZElO5kkWjhD4Ay

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2760	PITQN.EXE

Loads dropped DLL 2 IoCs

pid	Process
2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	PITQN.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\System Volume Information\\WTKRJV.EXE \"%1\" %*"	PITQN.EXE

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2020-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x0009000000016c35-10.dat	upx
behavioral1/files/0x000b000000012021-20.dat	upx
behavioral1/memory/2020-26-0x0000000001EB0000-0x0000000001F20000-memory.dmp	upx
behavioral1/files/0x000b000000012021-27.dat	upx
behavioral1/files/0x000b000000012021-22.dat	upx
behavioral1/memory/2760-29-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2020-30-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2760-32-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x000b000000012021-33.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HCWFUNM.EXE = "C:\\Windows\\HCWFUNM.EXE"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	PITQN.EXE
File opened (read-only)	\??\I:	PITQN.EXE
File opened (read-only)	\??\G:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\K:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\L:	PITQN.EXE
File opened (read-only)	\??\Q:	PITQN.EXE
File opened (read-only)	\??\E:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\Q:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\S:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\T:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\E:	PITQN.EXE
File opened (read-only)	\??\G:	PITQN.EXE
File opened (read-only)	\??\H:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\J:	PITQN.EXE
File opened (read-only)	\??\N:	PITQN.EXE
File opened (read-only)	\??\S:	PITQN.EXE
File opened (read-only)	\??\R:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\K:	PITQN.EXE
File opened (read-only)	\??\M:	PITQN.EXE
File opened (read-only)	\??\T:	PITQN.EXE
File opened (read-only)	\??\I:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\P:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\O:	PITQN.EXE
File opened (read-only)	\??\R:	PITQN.EXE
File opened (read-only)	\??\L:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\M:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\J:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\O:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\U:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\V:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\H:	PITQN.EXE
File opened (read-only)	\??\P:	PITQN.EXE
File opened (read-only)	\??\U:	PITQN.EXE
File opened (read-only)	\??\N:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PITQN.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File created	C:\Program Files\APTV.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened for modification	C:\Program Files\APTV.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HCWFUNM.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File created	C:\Windows\WUXZWZQ.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File created	C:\Windows\HCWFUNM.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Windows\\HCWFUNM.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\HCWFUNM.EXE \"%1\" %*"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\APTV.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Program Files\\APTV.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\HCWFUNM.EXE \"%1\""	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\System Volume Information\\WTKRJV.EXE \"%1\" %*"	PITQN.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Program Files\\APTV.EXE \"%1\""	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	PITQN.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	PITQN.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2760	2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	28
PID 2020 wrote to memory of 2760	2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	28
PID 2020 wrote to memory of 2760	2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	28
PID 2020 wrote to memory of 2760	2020	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\PITQN.EXE
  "C:\Program Files (x86)\PITQN.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PITQN.EXE

Filesize
482KB

MD5
925736ed4c18c5ad0fa084e9898b02d4

SHA1
b0712182a65b0318d5795883eb3154f11acf21e7

SHA256
a20de9dd3baf532ad24c6ce5aeffbd864c1fa3f0ee1ac5cbf59003609b122960

SHA512
a78231b3116aea01b543c43ce3e047e43dd898db8bb43dd702fadabdda2682fb791350d4d03ab5dfebd8c971a6ed4c057c1c0228449c75deb9374bfe8c2801f2

Download Submit
C:\Program Files (x86)\PITQN.EXE

Filesize
482KB

MD5
925736ed4c18c5ad0fa084e9898b02d4

SHA1
b0712182a65b0318d5795883eb3154f11acf21e7

SHA256
a20de9dd3baf532ad24c6ce5aeffbd864c1fa3f0ee1ac5cbf59003609b122960

SHA512
a78231b3116aea01b543c43ce3e047e43dd898db8bb43dd702fadabdda2682fb791350d4d03ab5dfebd8c971a6ed4c057c1c0228449c75deb9374bfe8c2801f2

Download Submit
C:\Program Files\APTV.EXE

Filesize
482KB

MD5
763deaf84f46bb4ae01807fdb7fdcad3

SHA1
3c58fa19093e5d6a7b357851796176722b826251

SHA256
11bc030a438291f80327c24f6d39a40beab1beae7b6b1dd646a8707f3524fc33

SHA512
8f2d0a5383d9d1bd6fa152cba9a6e1a52f3d801f05a73f9af57b1891a8de4d2814ce3d284315b4d114ebee3d6ae3d083fa4e7cf0c83bb4c6e6cee96808bad361

Download Submit
C:\filedebug

Filesize
235B

MD5
842c58241e0f606509ab06878540a46b

SHA1
7ebc1534b27b61742fb9f9d68a085d4cee0c97de

SHA256
e71a96bd822c66ded81ac0bbeb65f486ddb8bba61c5c0e2884d0487a8201f5b7

SHA512
35bde4f25f9e59d04b300c2d13a973e32f55c1da43aa897f13bde295731197bf0098b013f74bd0870567e8e0a31eab6813ad5f4ae5f66709fa7e5e2d263e21e2

Download Submit
\??\c:\filedebug

Filesize
276B

MD5
0bbc48bd77b2ecc9bf49b706eb43d7e0

SHA1
cc28d3015d5a6a598dc497cb590fd7771d99ad91

SHA256
f99cf8012c9d02d292df552d91fc50f24d9d7ee5a2d36f6ce7b688b2f692f30a

SHA512
d2738b743ffff2a49545f085280320112900095e3857c188bf466cd0a760639d144a1ccf3345dd532f8014b1e504f0366d8d8d5355451f7a6c5edb19e3a9dd8a

Download Submit
\Program Files (x86)\PITQN.EXE

Filesize
482KB

MD5
925736ed4c18c5ad0fa084e9898b02d4

SHA1
b0712182a65b0318d5795883eb3154f11acf21e7

SHA256
a20de9dd3baf532ad24c6ce5aeffbd864c1fa3f0ee1ac5cbf59003609b122960

SHA512
a78231b3116aea01b543c43ce3e047e43dd898db8bb43dd702fadabdda2682fb791350d4d03ab5dfebd8c971a6ed4c057c1c0228449c75deb9374bfe8c2801f2

Download Submit
\Program Files (x86)\PITQN.EXE

Filesize
482KB

MD5
925736ed4c18c5ad0fa084e9898b02d4

SHA1
b0712182a65b0318d5795883eb3154f11acf21e7

SHA256
a20de9dd3baf532ad24c6ce5aeffbd864c1fa3f0ee1ac5cbf59003609b122960

SHA512
a78231b3116aea01b543c43ce3e047e43dd898db8bb43dd702fadabdda2682fb791350d4d03ab5dfebd8c971a6ed4c057c1c0228449c75deb9374bfe8c2801f2

Download Submit
memory/2020-28-0x0000000001EB0000-0x0000000001F20000-memory.dmp

Filesize
448KB

Download
memory/2020-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2020-30-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2020-26-0x0000000001EB0000-0x0000000001F20000-memory.dmp

Filesize
448KB

Download
memory/2020-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2760-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2760-31-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2760-32-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads