Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    08/10/2023, 17:02

General

  • Target

    NEAS.00e3d10e003f9f9abde9a4403e31543ad2cb48a2149066b45771fc2c03030e59_JC.exe

  • Size

    14.3MB

  • MD5

    8ef72af893e61f61fa3813627c444a2d

  • SHA1

    6f842049f803d49be1f1d2f6dd263380bf85fe0e

  • SHA256

    00e3d10e003f9f9abde9a4403e31543ad2cb48a2149066b45771fc2c03030e59

  • SHA512

    86294018c998a2b11503ac8645d6b270016d9e703a0a780a4544f2deecee5c505559f371aa40290f58808bb9a714feaa44f26c5ba12026c18ea8cbc40fccf898

  • SSDEEP

    393216:sObVsTKckqLk4OEbeMbppEvlXqn5HBHGRXNe:vbKgqwEbecpIKdgg

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.00e3d10e003f9f9abde9a4403e31543ad2cb48a2149066b45771fc2c03030e59_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.00e3d10e003f9f9abde9a4403e31543ad2cb48a2149066b45771fc2c03030e59_JC.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9IOZ64VQ\c_login_2[2].js

    Filesize

    208KB

    MD5

    8a50869763c7bb96e157b849e9469367

    SHA1

    9efc7fbc712d178f89680aa945acff01c184351f

    SHA256

    a540989b9f9bef8b4763c2b0052515e0897817b7013a05dee755c7517867217b

    SHA512

    b5e0c91c26b6c02f1fe9c43dad52b27041b4ff9a6f22ffb2d99a0a1ab63c733fbcd670699ecca8a3665ed6a18c2800243fea250eb3073e9a871d48b98f0349f0

  • memory/2304-0-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-1-0x0000000077040000-0x0000000077042000-memory.dmp

    Filesize

    8KB

  • memory/2304-2-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-4-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-6-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-8-0x0000000005220000-0x0000000005221000-memory.dmp

    Filesize

    4KB

  • memory/2304-12-0x00000000052A0000-0x00000000052A1000-memory.dmp

    Filesize

    4KB

  • memory/2304-14-0x00000000051B0000-0x00000000051B1000-memory.dmp

    Filesize

    4KB

  • memory/2304-13-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-18-0x00000000051E0000-0x00000000051E2000-memory.dmp

    Filesize

    8KB

  • memory/2304-17-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-16-0x00000000051C0000-0x00000000051C1000-memory.dmp

    Filesize

    4KB

  • memory/2304-10-0x00000000052D0000-0x00000000052D1000-memory.dmp

    Filesize

    4KB

  • memory/2304-9-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-7-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-5-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-20-0x0000000005310000-0x0000000005311000-memory.dmp

    Filesize

    4KB

  • memory/2304-22-0x0000000005200000-0x0000000005201000-memory.dmp

    Filesize

    4KB

  • memory/2304-24-0x0000000005280000-0x0000000005281000-memory.dmp

    Filesize

    4KB

  • memory/2304-21-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-26-0x00000000051F0000-0x00000000051F1000-memory.dmp

    Filesize

    4KB

  • memory/2304-30-0x0000000005230000-0x0000000005231000-memory.dmp

    Filesize

    4KB

  • memory/2304-29-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-28-0x00000000051D0000-0x00000000051D1000-memory.dmp

    Filesize

    4KB

  • memory/2304-25-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-32-0x0000000005270000-0x0000000005271000-memory.dmp

    Filesize

    4KB

  • memory/2304-34-0x00000000052E0000-0x00000000052E1000-memory.dmp

    Filesize

    4KB

  • memory/2304-36-0x0000000005360000-0x0000000005361000-memory.dmp

    Filesize

    4KB

  • memory/2304-38-0x00000000052B0000-0x00000000052B1000-memory.dmp

    Filesize

    4KB

  • memory/2304-40-0x0000000005370000-0x0000000005371000-memory.dmp

    Filesize

    4KB

  • memory/2304-42-0x0000000005380000-0x0000000005381000-memory.dmp

    Filesize

    4KB

  • memory/2304-44-0x0000000005260000-0x0000000005261000-memory.dmp

    Filesize

    4KB

  • memory/2304-41-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-46-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

    Filesize

    4KB

  • memory/2304-45-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-48-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-37-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-33-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-51-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-53-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-55-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-57-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-59-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-62-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-61-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-64-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-66-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-71-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-69-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-72-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2304-74-0x0000000005320000-0x0000000005321000-memory.dmp

    Filesize

    4KB

  • memory/2304-75-0x0000000005330000-0x0000000005331000-memory.dmp

    Filesize

    4KB

  • memory/2304-93-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-151-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-159-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-160-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-161-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-162-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-165-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-166-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-167-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-168-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-169-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-170-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-171-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB

  • memory/2304-176-0x0000000000400000-0x0000000001679000-memory.dmp

    Filesize

    18.5MB