Analysis
-
max time kernel
154s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14-10-2023 17:49
General
-
Target
NEAS.296d390d5729be1bf51c361c1968e570.exe
-
Size
2.4MB
-
MD5
296d390d5729be1bf51c361c1968e570
-
SHA1
ba71371c700c51d3cb19fa9f398120b6870ac818
-
SHA256
b20b0a6814a33cf37e3be53c99c1bfb40092545ef6cabf6b75cfd13e43aa172e
-
SHA512
7e7fc6ea660fbc8608888cf91f2b9e0d5adf1bb3faf06b092f2d48475d3dcadad94d8e5c01e389e8c55b1f426698d359059fe0a02778574e74059c1397c6d4c6
-
SSDEEP
49152:ZE13D8c4GG/jfKCfGgY1zpjG6xiYfFzKeAxk:8Ho/OKG91zpC6xiYfFWe7
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.296d390d5729be1bf51c361c1968e570.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.296d390d5729be1bf51c361c1968e570.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB