Overview

overview

10

Static

static

3

NEAS.79f7c...c0.exe

windows7-x64

10

NEAS.79f7c...c0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 20:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe

  • Size

    279KB

  • MD5

    79f7c9976d94b597ef9cec6780cf40c0

  • SHA1

    24f774232a3074a891611876600507490f69e3b9

  • SHA256

    12c1978f46aacf94582f319bc3379f3bfab041b2519ad5a73e63f8a96943bc16

  • SHA512

    693c916f258da870c5507dbf2ac5328e50514fb8bc8571ee9cf04bb621c58b8a2c4bda301c38c139eeda0c0c38f15ab7287844334d52601d8cfc03efdd41db81

  • SSDEEP

    6144:m7OQ0l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:m7lRGgdoz5LDsOddkUBc9M

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5108
    • C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
      C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe startC:\Users\Admin\AppData\Roaming\BFFD4\1D8AF.exe%C:\Users\Admin\AppData\Roaming\BFFD4
      2⤵
        PID:2724
      • C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
        C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe startC:\Program Files (x86)\D44E7\lvvm.exe%C:\Program Files (x86)\D44E7
        2⤵
          PID:3880
        • C:\Program Files (x86)\LP\AF4B\C8E9.tmp
          "C:\Program Files (x86)\LP\AF4B\C8E9.tmp"
          2⤵
          • Executes dropped EXE
          PID:4284
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3468
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3432
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        PID:560
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3752
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:640
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5040
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:940
      • C:\Windows\system32\werfault.exe
        werfault.exe /hc /shared Global\0ff2c81b103b4c1aaee300a030808095 /t 3356 /p 3360
        1⤵
          PID:1172
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4128
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4956
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2556
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3836

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\LP\AF4B\C8E9.tmp
              Filesize

              99KB

              MD5

              cb853d0e676be7b23903aa89175d8d69

              SHA1

              2066462d42c45133df60c5e5f9e8956373d191b0

              SHA256

              7291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20

              SHA512

              bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038

              Download Submit

            • C:\Program Files (x86)\LP\AF4B\C8E9.tmp
              Filesize

              99KB

              MD5

              cb853d0e676be7b23903aa89175d8d69

              SHA1

              2066462d42c45133df60c5e5f9e8956373d191b0

              SHA256

              7291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20

              SHA512

              bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133392355733064044.txt
              Filesize

              75KB

              MD5

              62d81c2e1e8b21733f95af2a596e4b18

              SHA1

              91c005ecc5ae4171f450c43c02d1ba532b4474c6

              SHA256

              a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

              SHA512

              c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

              Download Submit

            • C:\Users\Admin\AppData\Roaming\BFFD4\44E7.FFD
              Filesize

              600B

              MD5

              ba23ef9a0855ead265440ce5fcc4b5e4

              SHA1

              fdc6213fcb4fd64a08d435faf7e94f499683a563

              SHA256

              667b38507243549ad3244b619334eb8b2eb279ba388fba90d47550551413e3a0

              SHA512

              43458a8f1d285b7eeba2e5c65375b5eeef7fe6d949d058b1644cc9845c01362537d8af6cc12b800367bc37e3960291e98da89fa3f9191f8f58c5294d24373d43

              Download Submit

            • C:\Users\Admin\AppData\Roaming\BFFD4\44E7.FFD
              Filesize

              996B

              MD5

              c6f61fdc03d51d9d9475aebe3df0d1e2

              SHA1

              133ddd6facd2deb7d52b3112ded1ec91c0ceb76b

              SHA256

              2bd1fdac674cd95bfc9462a316ba1a606ab47b3cfa3d6216240d9c0e2c4f4c78

              SHA512

              e89762352dad25b933df0cac99f7ca118f28e7f3d67529832b10495048c50242d8da23e2ff88fac5a2bb40557a49f2a87b837a59264b0ca4a8bdd0b2cf034d21

              Download Submit

            • memory/2556-195-0x0000000004B50000-0x0000000004B51000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-17-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/2724-15-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/2724-16-0x0000000000490000-0x0000000000590000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3880-76-0x0000000000700000-0x0000000000800000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3880-77-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/4284-167-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4284-174-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4284-166-0x0000000000600000-0x0000000000700000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4284-165-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4284-160-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4284-159-0x0000000000600000-0x0000000000700000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4284-158-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4956-201-0x000001B30A190000-0x000001B30A1B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4956-205-0x000001B30A150000-0x000001B30A170000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4956-208-0x000001B30A760000-0x000001B30A780000-memory.dmp

              Filesize

              128KB

              Download

            • memory/5108-156-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-5-0x0000000000670000-0x0000000000770000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/5108-6-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-18-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-1-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-3-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-80-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-190-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/5108-2-0x0000000000670000-0x0000000000770000-memory.dmp

              Filesize

              1024KB

              Download