82d3a386dbed3450612df8267523f204a823c6809401da6fe16441340573dda3

Analysis

max time kernel
147s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Size

3.2MB
MD5

7866cd3f054d877ecf187047d5e4d340
SHA1

1fbbe17f21389c03a50dda5d25caf62bae05da3a
SHA256

82d3a386dbed3450612df8267523f204a823c6809401da6fe16441340573dda3
SHA512

46a4673891ffbe8785722dbae44e4bdfe22526c78ecaccb5b1f9fed63331377b0da0ea1ea3d3533247a87e82ee333dbe8ce203a81af84fb137a129ece0a82878
SSDEEP

98304:Lnob5A1YqdCPpnvOVrt8pppcqqRklqJSCTS3x:3VUPpnvOX8pbWeIhT2

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Wine	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\ = "CoreAuto Object"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\HELPDIR	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib\Version = "1.0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ = "IEvCoreAuto"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Orion.CoreAuto\Clsid	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib\Version = "1.0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ = "ICoreAuto"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\Version	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\ = "Orion Library"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ProxyStubClsid32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib\ = "{30EB0008-5407-11D4-0000-00601C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Orion.CoreAuto	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\ProgID	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\ProgID\ = "Orion.CoreAuto"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ProxyStubClsid32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ = "ICoreAuto"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib\ = "{30EB0008-5407-11D4-0000-00601C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\LocalServer32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.7866cd3f054d877ecf187047d5e4d340.exe"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib\Version = "1.0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib\ = "{30EB0008-5407-11D4-0000-00601C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\TypeLib\ = "{30EB0008-5407-11D4-0000-00601C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Orion.CoreAuto\Clsid\ = "{30EB1843-5407-11D4-AA1C-00001C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ = "IEvCoreAuto"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.7866cd3f054d877ecf187047d5e4d340.exe"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\TypeLib	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib\Version = "1.0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ProxyStubClsid32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\ProxyStubClsid32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}\TypeLib\ = "{30EB0008-5407-11D4-0000-00601C031E8C}"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}\Version\ = "1.0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\FLAGS	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\FLAGS\ = "0"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\0\win32	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30EB1841-5407-11D4-AA1C-00001C031E8C}\TypeLib	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CC8BA-B327-4293-92F2-BD89702FC0DE}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30EB0008-5407-11D4-0000-00601C031E8C}\1.0\0	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30EB1843-5407-11D4-AA1C-00001C031E8C}	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Orion.CoreAuto\ = "CoreAuto Object"	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4740	NEAS.7866cd3f054d877ecf187047d5e4d340.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.7866cd3f054d877ecf187047d5e4d340.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7866cd3f054d877ecf187047d5e4d340.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-0-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-1-0x0000000077134000-0x0000000077136000-memory.dmp

Filesize
8KB

Download
memory/4740-2-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-3-0x000000000B810000-0x000000000B811000-memory.dmp

Filesize
4KB

Download
memory/4740-4-0x000000000B7F0000-0x000000000B7F1000-memory.dmp

Filesize
4KB

Download
memory/4740-5-0x000000000B7E0000-0x000000000B7E2000-memory.dmp

Filesize
8KB

Download
memory/4740-6-0x000000000B7C0000-0x000000000B7C1000-memory.dmp

Filesize
4KB

Download
memory/4740-7-0x000000000B800000-0x000000000B801000-memory.dmp

Filesize
4KB

Download
memory/4740-8-0x000000000B7D0000-0x000000000B7D1000-memory.dmp

Filesize
4KB

Download
memory/4740-10-0x000000000B860000-0x000000000B861000-memory.dmp

Filesize
4KB

Download
memory/4740-9-0x000000000B830000-0x000000000B831000-memory.dmp

Filesize
4KB

Download
memory/4740-13-0x000000000B840000-0x000000000B841000-memory.dmp

Filesize
4KB

Download
memory/4740-12-0x000000000B870000-0x000000000B871000-memory.dmp

Filesize
4KB

Download
memory/4740-18-0x000000000BB10000-0x000000000BB12000-memory.dmp

Filesize
8KB

Download
memory/4740-17-0x000000000B980000-0x000000000B981000-memory.dmp

Filesize
4KB

Download
memory/4740-16-0x000000000B950000-0x000000000B951000-memory.dmp

Filesize
4KB

Download
memory/4740-15-0x000000000B940000-0x000000000B941000-memory.dmp

Filesize
4KB

Download
memory/4740-19-0x000000000B900000-0x000000000B901000-memory.dmp

Filesize
4KB

Download
memory/4740-20-0x000000000B930000-0x000000000B931000-memory.dmp

Filesize
4KB

Download
memory/4740-21-0x000000000B780000-0x000000000B781000-memory.dmp

Filesize
4KB

Download
memory/4740-22-0x000000000B920000-0x000000000B921000-memory.dmp

Filesize
4KB

Download
memory/4740-14-0x000000000B8B0000-0x000000000B8B1000-memory.dmp

Filesize
4KB

Download
memory/4740-11-0x000000000B880000-0x000000000B881000-memory.dmp

Filesize
4KB

Download
memory/4740-23-0x000000000B8E0000-0x000000000B8E1000-memory.dmp

Filesize
4KB

Download
memory/4740-24-0x000000000B890000-0x000000000B891000-memory.dmp

Filesize
4KB

Download
memory/4740-25-0x000000000B820000-0x000000000B821000-memory.dmp

Filesize
4KB

Download
memory/4740-26-0x000000000B960000-0x000000000B961000-memory.dmp

Filesize
4KB

Download
memory/4740-27-0x000000000B8A0000-0x000000000B8A1000-memory.dmp

Filesize
4KB

Download
memory/4740-28-0x000000000BB20000-0x000000000BB22000-memory.dmp

Filesize
8KB

Download
memory/4740-29-0x000000000B910000-0x000000000B911000-memory.dmp

Filesize
4KB

Download
memory/4740-30-0x000000000B8F0000-0x000000000B8F1000-memory.dmp

Filesize
4KB

Download
memory/4740-33-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/4740-34-0x000000000B8C0000-0x000000000B8C1000-memory.dmp

Filesize
4KB

Download
memory/4740-35-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-36-0x000000000B780000-0x000000000B781000-memory.dmp

Filesize
4KB

Download
memory/4740-37-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-38-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-39-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-40-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-41-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-42-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-43-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-44-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-45-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-46-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-47-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-48-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-49-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download
memory/4740-50-0x0000000000400000-0x0000000000BD3000-memory.dmp

Filesize
7.8MB

Download