38e2284c1ff0b7feb38573a812bca812c278cc93b04f8540a8d6eb8cc7f55db1

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
Size

206KB
MD5

c5be765fb811ba6ee330ce34489c3e40
SHA1

4c98496db0aa5c25bf5f940d449f3faa8e53dcf1
SHA256

38e2284c1ff0b7feb38573a812bca812c278cc93b04f8540a8d6eb8cc7f55db1
SHA512

b136e99cc54cd730b9643d4a407967f598fce2332430f51182e14d05182182aa452b5a4b1ecdb6663e429cf1e171e86bf2c74ce0c3627d0a4eb360296cf7ba74
SSDEEP

3072:lvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un2u:lvEN2U+T6i5LirrllHy4HUcMQY64

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2892	explorer.exe
4812	spoolsv.exe
2180	svchost.exe
1444	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe
2180	svchost.exe
2892	explorer.exe
2892	explorer.exe
2180	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2892	explorer.exe
2180	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
2892	explorer.exe
2892	explorer.exe
4812	spoolsv.exe
4812	spoolsv.exe
2180	svchost.exe
2180	svchost.exe
1444	spoolsv.exe
1444	spoolsv.exe
2892	explorer.exe
2892	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2892	716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe	86
PID 716 wrote to memory of 2892	716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe	86
PID 716 wrote to memory of 2892	716	NEAS.c5be765fb811ba6ee330ce34489c3e40.exe	86
PID 2892 wrote to memory of 4812	2892	explorer.exe	87
PID 2892 wrote to memory of 4812	2892	explorer.exe	87
PID 2892 wrote to memory of 4812	2892	explorer.exe	87
PID 4812 wrote to memory of 2180	4812	spoolsv.exe	88
PID 4812 wrote to memory of 2180	4812	spoolsv.exe	88
PID 4812 wrote to memory of 2180	4812	spoolsv.exe	88
PID 2180 wrote to memory of 1444	2180	svchost.exe	89
PID 2180 wrote to memory of 1444	2180	svchost.exe	89
PID 2180 wrote to memory of 1444	2180	svchost.exe	89
PID 2180 wrote to memory of 2004	2180	svchost.exe	90
PID 2180 wrote to memory of 2004	2180	svchost.exe	90
PID 2180 wrote to memory of 2004	2180	svchost.exe	90
PID 2180 wrote to memory of 4212	2180	svchost.exe	103
PID 2180 wrote to memory of 4212	2180	svchost.exe	103
PID 2180 wrote to memory of 4212	2180	svchost.exe	103
PID 2180 wrote to memory of 3672	2180	svchost.exe	105
PID 2180 wrote to memory of 3672	2180	svchost.exe	105
PID 2180 wrote to memory of 3672	2180	svchost.exe	105

C:\Users\Admin\AppData\Local\Temp\NEAS.c5be765fb811ba6ee330ce34489c3e40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c5be765fb811ba6ee330ce34489c3e40.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2004
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4212
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
207KB

MD5
88fb2e434b819f656a37e90489dcf6b2

SHA1
e4b44eb5edc8de83f153a89fd826935e0dd05230

SHA256
5d88a6410e61083d9b830df4f8ed282da0f849c07b829c9c7262d5794c25936e

SHA512
011d6dcf1e8ec242a0c94a2cffa06074a136d4db4009d5ffc96f5b69a13235ad6a0502dcd0d437aa4fcc0277434ae663ac9753b0ffa4dec58c7b3ce0a6271752

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
efac96747d8dde6166274d7bb032fb5e

SHA1
9ff34a90051d7c713d67d8158f356fed46018179

SHA256
f32b02744f1ad777e54ea668005530eb96f2eb7c9ed7f5d62f06aa32de0c1f26

SHA512
b581b9f68caef0b63bdbd1cd85baec031e6450952b990ef076dbe0cbd6de4e29cc77d536421abb0668a5722df1f4ce55434b59a8615d68790aba651e72cbaa54

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c79155f4f832a65b5e7b182ec7c32242

SHA1
94ce2a49a4bb8da3048cffcaa71d0b942083e219

SHA256
f99042459f4a0777691249211de881fe3aecdd5ac1f582679ae337660d1b6b8f

SHA512
289d9eb0116698dec1243539150da029cc140b484852401813317251a0680ec98616bb4a613586915c057c12cbb9c6c60bfe6df027bbb8725d9d094d667a6b80

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c79155f4f832a65b5e7b182ec7c32242

SHA1
94ce2a49a4bb8da3048cffcaa71d0b942083e219

SHA256
f99042459f4a0777691249211de881fe3aecdd5ac1f582679ae337660d1b6b8f

SHA512
289d9eb0116698dec1243539150da029cc140b484852401813317251a0680ec98616bb4a613586915c057c12cbb9c6c60bfe6df027bbb8725d9d094d667a6b80

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c79155f4f832a65b5e7b182ec7c32242

SHA1
94ce2a49a4bb8da3048cffcaa71d0b942083e219

SHA256
f99042459f4a0777691249211de881fe3aecdd5ac1f582679ae337660d1b6b8f

SHA512
289d9eb0116698dec1243539150da029cc140b484852401813317251a0680ec98616bb4a613586915c057c12cbb9c6c60bfe6df027bbb8725d9d094d667a6b80

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
d8f680a25d9fcfcc41bab905cc244f6a

SHA1
7024a466783f36dcff949a25836d75a1c155033e

SHA256
c046f5a1827d94caf4b32aa1281c272fb92e71787a4390a600f9907fdc0846af

SHA512
a6003a67bf9873d9d0036577c832052906717db3caa40ea8d5b7b2e02e4f8a06f607a1ef62e8ebda185dff568886a98c5e207ad67526fadea4c47a86e3d510bb

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
efac96747d8dde6166274d7bb032fb5e

SHA1
9ff34a90051d7c713d67d8158f356fed46018179

SHA256
f32b02744f1ad777e54ea668005530eb96f2eb7c9ed7f5d62f06aa32de0c1f26

SHA512
b581b9f68caef0b63bdbd1cd85baec031e6450952b990ef076dbe0cbd6de4e29cc77d536421abb0668a5722df1f4ce55434b59a8615d68790aba651e72cbaa54

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
c79155f4f832a65b5e7b182ec7c32242

SHA1
94ce2a49a4bb8da3048cffcaa71d0b942083e219

SHA256
f99042459f4a0777691249211de881fe3aecdd5ac1f582679ae337660d1b6b8f

SHA512
289d9eb0116698dec1243539150da029cc140b484852401813317251a0680ec98616bb4a613586915c057c12cbb9c6c60bfe6df027bbb8725d9d094d667a6b80

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
d8f680a25d9fcfcc41bab905cc244f6a

SHA1
7024a466783f36dcff949a25836d75a1c155033e

SHA256
c046f5a1827d94caf4b32aa1281c272fb92e71787a4390a600f9907fdc0846af

SHA512
a6003a67bf9873d9d0036577c832052906717db3caa40ea8d5b7b2e02e4f8a06f607a1ef62e8ebda185dff568886a98c5e207ad67526fadea4c47a86e3d510bb

Download Submit
memory/716-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/716-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2180-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-38-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4812-35-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download