152285e43b43e21b5565498c9fd20cefd8a4e0f88077b72786665ff16315b184

General

Target

NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Size

297KB
MD5

d2093a12c26ccb442b4f3ff378505640
SHA1

3cb6d0611aeab0de663c6ce393cb4f66cff12807
SHA256

152285e43b43e21b5565498c9fd20cefd8a4e0f88077b72786665ff16315b184
SHA512

fad41cdcbe12ce2f409cbae48f9991e4983f5348db91404c08650977c1aef5b610013a623a7778b10d2e33470944b137c7e5ded8a7d479fb5d1429eb4e3bd5dd
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26OoN:/pW2IoioS6N

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	NEAS.d2093a12c26ccb442b4f3ff378505640.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe BATCF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe NTPAD %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe NTPAD %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe CMDSF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe VBSSF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe HTMWF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtffile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe RTFDF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe NTPAD %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe NTPAD %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe BATCF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\giffile\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.d2093a12c26ccb442b4f3ff378505640.exe JPGIF %1"	NEAS.d2093a12c26ccb442b4f3ff378505640.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
440	reg.exe
4932	reg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 440	2020	NEAS.d2093a12c26ccb442b4f3ff378505640.exe	88
PID 2020 wrote to memory of 440	2020	NEAS.d2093a12c26ccb442b4f3ff378505640.exe	88
PID 2020 wrote to memory of 4932	2020	NEAS.d2093a12c26ccb442b4f3ff378505640.exe	89
PID 2020 wrote to memory of 4932	2020	NEAS.d2093a12c26ccb442b4f3ff378505640.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.d2093a12c26ccb442b4f3ff378505640.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d2093a12c26ccb442b4f3ff378505640.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:440
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Ak2qP8lmDZ.exe

Filesize
297KB

MD5
442f5b69e45bfb3e331a8458d81d74bc

SHA1
da2334c9363bb6e8008b58ef259ee29292681a58

SHA256
78c2355a06f648748cdcfac837bb408a1c78769ae85a9cd09ec31598f99f7ed8

SHA512
68ecd3f4ff993d108b4f0d64a72dbd2e7bc0a40ff15b66ae16dcb5e078207acafb2fa1d79b097b9733c2fb78abdee3290fb4af126660d0f19e8c72e490161d0f

Download Submit
memory/2020-0-0x000001A52F1B0000-0x000001A52F1D8000-memory.dmp

Filesize
160KB

Download
memory/2020-1-0x00007FF8DB180000-0x00007FF8DBC41000-memory.dmp

Filesize
10.8MB

Download
memory/2020-2-0x000001A530D80000-0x000001A530D90000-memory.dmp

Filesize
64KB

Download
memory/2020-3-0x00007FF8DB180000-0x00007FF8DBC41000-memory.dmp

Filesize
10.8MB

Download
memory/2020-4-0x000001A530D80000-0x000001A530D90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads