45adf5ec60fc488c46bea8d719c14e8f7c12d343c2288bae8608d4db5a71faef

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
Size

135KB
MD5

4ea1a42d62bbcce91284af6179e470a0
SHA1

15bc5f47c736f13996b603c4c48803cf8dcc0c19
SHA256

45adf5ec60fc488c46bea8d719c14e8f7c12d343c2288bae8608d4db5a71faef
SHA512

176debb9aba1561ca8b067e25bfff3e83b984d0c53ab96b37e704d83f7c5e89c6c51e57cf3aabda290c620fc246ede86d532acad25bb329dd0701eb1ac172d86
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBXf:UVqoCl/YgjxEufVU0TbTyDDalnf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
336	explorer.exe
3892	spoolsv.exe
4880	svchost.exe
4320	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe
336	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
336	explorer.exe
4880	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
336	explorer.exe
336	explorer.exe
3892	spoolsv.exe
3892	spoolsv.exe
4880	svchost.exe
4880	svchost.exe
4320	spoolsv.exe
4320	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 336	5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe	86
PID 5088 wrote to memory of 336	5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe	86
PID 5088 wrote to memory of 336	5088	NEAS.4ea1a42d62bbcce91284af6179e470a0.exe	86
PID 336 wrote to memory of 3892	336	explorer.exe	87
PID 336 wrote to memory of 3892	336	explorer.exe	87
PID 336 wrote to memory of 3892	336	explorer.exe	87
PID 3892 wrote to memory of 4880	3892	spoolsv.exe	88
PID 3892 wrote to memory of 4880	3892	spoolsv.exe	88
PID 3892 wrote to memory of 4880	3892	spoolsv.exe	88
PID 4880 wrote to memory of 4320	4880	svchost.exe	89
PID 4880 wrote to memory of 4320	4880	svchost.exe	89
PID 4880 wrote to memory of 4320	4880	svchost.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4ea1a42d62bbcce91284af6179e470a0.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:336
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4880
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
2a948096bcd4602498b89dabb080cfc5

SHA1
d2784bf2b066ebc5f0a2fc8f9492cdba1e6ad908

SHA256
cc5a6cd02e668c90ce4fc359f34cac8cbdaa2aafe7fe793fea5b0a8b03ba1efd

SHA512
c293c52a73b8cffd24b737dee9263f52721cbd49033d577e841ace964f9c435019744f9474c01b1fc63828e638d52e0a021ccd222e531dadf75a7b00e77d87a3

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
e116f7e98152c513ed6c221f38b5d00d

SHA1
38f50c8397dbf50bd3238f335aadcb72e914841f

SHA256
efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152

SHA512
4d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
e116f7e98152c513ed6c221f38b5d00d

SHA1
38f50c8397dbf50bd3238f335aadcb72e914841f

SHA256
efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152

SHA512
4d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
e116f7e98152c513ed6c221f38b5d00d

SHA1
38f50c8397dbf50bd3238f335aadcb72e914841f

SHA256
efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152

SHA512
4d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
40fc53c54f1af6c7d682575cecb6c2b6

SHA1
9b98f7efa63d1c15232eb7e899c9f2caa00fe8fb

SHA256
900f7a39d8ea0a616a869224f9290e53bcf134ebdcb9051cccbe93f66dad8f41

SHA512
d72642c778ceb6f374b1664174c28bea0980fc8d9c4167f99e1a7fd8fd18d99fc1e2d8cecce7de58247449f6cbcfa5d5c36e335d323165ac67729ef46e58a980

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
e116f7e98152c513ed6c221f38b5d00d

SHA1
38f50c8397dbf50bd3238f335aadcb72e914841f

SHA256
efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152

SHA512
4d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
40fc53c54f1af6c7d682575cecb6c2b6

SHA1
9b98f7efa63d1c15232eb7e899c9f2caa00fe8fb

SHA256
900f7a39d8ea0a616a869224f9290e53bcf134ebdcb9051cccbe93f66dad8f41

SHA512
d72642c778ceb6f374b1664174c28bea0980fc8d9c4167f99e1a7fd8fd18d99fc1e2d8cecce7de58247449f6cbcfa5d5c36e335d323165ac67729ef46e58a980

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
2a948096bcd4602498b89dabb080cfc5

SHA1
d2784bf2b066ebc5f0a2fc8f9492cdba1e6ad908

SHA256
cc5a6cd02e668c90ce4fc359f34cac8cbdaa2aafe7fe793fea5b0a8b03ba1efd

SHA512
c293c52a73b8cffd24b737dee9263f52721cbd49033d577e841ace964f9c435019744f9474c01b1fc63828e638d52e0a021ccd222e531dadf75a7b00e77d87a3

Download Submit
memory/336-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3892-30-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4320-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4880-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5088-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5088-31-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download