2357bcbaad3f572baf8f83c385ec01ff75555ec959db844c27cbe8e8710acf7e

Analysis

max time kernel
161s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
Size

34KB
MD5

78cd6a7e63c8fbd6dc153e6054ce22e0
SHA1

96a01d15cbbfa46cf9a3729fb32a2eb6852504d3
SHA256

2357bcbaad3f572baf8f83c385ec01ff75555ec959db844c27cbe8e8710acf7e
SHA512

43b6083552857d6caf81421c8d2edaa01ac0049f9ab10185773d18efbd704f065a38543af3964d08d6b1086a37050cc26e90209418efd7c6e6fdfaed1ec9a70e
SSDEEP

768:cUUC151Npquv3RnFKE7pGnbcuyD7UXEvyq:cU5bLpXRkPnouy8UX

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	trys.exe

Loads dropped DLL 5 IoCs

pid	Process
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2144-3-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/files/0x000b00000001225e-26.dat	upx
behavioral1/files/0x000b00000001225e-38.dat	upx
behavioral1/files/0x000b00000001225e-36.dat	upx
behavioral1/files/0x000b00000001225e-33.dat	upx
behavioral1/files/0x000b00000001225e-29.dat	upx
behavioral1/files/0x000b00000001225e-28.dat	upx
behavioral1/memory/2144-40-0x0000000001F60000-0x0000000001F6C000-memory.dmp	upx
behavioral1/files/0x000b00000001225e-41.dat	upx
behavioral1/memory/2812-45-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2144-48-0x0000000001F60000-0x0000000001F6C000-memory.dmp	upx
behavioral1/memory/2812-51-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe
Token: SeDebugPrivilege	2812	trys.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
2812	trys.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2868	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	30
PID 2144 wrote to memory of 2868	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	30
PID 2144 wrote to memory of 2868	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	30
PID 2144 wrote to memory of 2868	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	30
PID 2868 wrote to memory of 2684	2868	cmd.exe	32
PID 2868 wrote to memory of 2684	2868	cmd.exe	32
PID 2868 wrote to memory of 2684	2868	cmd.exe	32
PID 2868 wrote to memory of 2684	2868	cmd.exe	32
PID 2144 wrote to memory of 2812	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	33
PID 2144 wrote to memory of 2812	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	33
PID 2144 wrote to memory of 2812	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	33
PID 2144 wrote to memory of 2812	2144	NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe	33

C:\Users\Admin\AppData\Local\Temp\NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.78cd6a7e63c8fbd6dc153e6054ce22e0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\UCPPB.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2684
- C:\Users\Admin\AppData\Roaming\trys.exe
  "C:\Users\Admin\AppData\Roaming\trys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UCPPB.bat

Filesize
135B

MD5
6dbb2090ff90500da05a027765cde190

SHA1
425b833d9d1df8d6df6e5a59f738058808271949

SHA256
71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

SHA512
7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\UCPPB.bat

Filesize
135B

MD5
6dbb2090ff90500da05a027765cde190

SHA1
425b833d9d1df8d6df6e5a59f738058808271949

SHA256
71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

SHA512
7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

Download Submit
C:\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
C:\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
\Users\Admin\AppData\Roaming\trys.exe

Filesize
34KB

MD5
24e850d11fffb2064fb731c5cba01772

SHA1
cc2e91d2556f4ef4e1dd11815e5fa1c51a2e9483

SHA256
5211f738e9726795ede058589409b446d4ce5d2910ea1d5ceb310b2f721b114f

SHA512
1ae71d58bc20d14364d009bc1ba170fa57ce7d0011d5645a2e7f639141d16d94ade3b36fd5042d4c678ecba18aee9d3ca65ba4e0ca5c3ae21c3fdf6977a4e104

Download Submit
memory/2144-40-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Filesize
48KB

Download
memory/2144-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2144-42-0x0000000002030000-0x000000000203C000-memory.dmp

Filesize
48KB

Download
memory/2144-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2144-43-0x0000000002030000-0x000000000203C000-memory.dmp

Filesize
48KB

Download
memory/2144-47-0x0000000002030000-0x000000000203C000-memory.dmp

Filesize
48KB

Download
memory/2144-48-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Filesize
48KB

Download
memory/2144-49-0x0000000002030000-0x000000000203C000-memory.dmp

Filesize
48KB

Download
memory/2144-50-0x0000000002030000-0x000000000203C000-memory.dmp

Filesize
48KB

Download
memory/2812-45-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2812-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads