Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 18:04
Behavioral task
behavioral1
Sample
NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe
Resource
win7-20230831-en
windows7-x64
General
-
Target
NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe
-
Size
346KB
-
MD5
87e7d4cb4a0d4e2523e03bc159bef7d0
-
SHA1
357d1149fe49928e2868238b8cf9598c557a5a7b
-
SHA256
75161078d75acead13d1a4236df271476c17a7be656cbc536a996cdddc69db5c
-
SHA512
23279a35049fa7a4dea72f1de343a42f599d0a9e1d02d475548dd8f53aa5ac77ec890d60596b958215150bd080632ece4bef9fe3bde0b546dad5b1d3d2079a55
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+W:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4W
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4556 svhost.exe -
resource yara_rule behavioral2/memory/4416-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000200000002281c-3.dat upx behavioral2/files/0x000200000002281c-4.dat upx behavioral2/memory/4556-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0006000000023255-104.dat upx behavioral2/memory/4416-284-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/4556-400-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4416-284-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/4556-400-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4556 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe 4556 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4416 wrote to memory of 4556 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 86 PID 4416 wrote to memory of 4556 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 86 PID 4416 wrote to memory of 4556 4416 NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
346KB
MD5367d0ccf543247cffe148b9a3b145575
SHA13fcf0b4edb4e663f7630e02c2d24d54ab054bc55
SHA256c92d5ddf0395a95833b52d0542a9ce768b0cfef8f2ac851f84bed4735e7e5718
SHA5121ec9d7f35797803f937bcbd6b8307970fa2e1221a5609e92436e50861637bf6df2d6d90f74a6ebd85a329f3ffbaf4d601a7e9a6b3a53ca6b8edf53b1da862eea
-
Filesize
346KB
MD5367d0ccf543247cffe148b9a3b145575
SHA13fcf0b4edb4e663f7630e02c2d24d54ab054bc55
SHA256c92d5ddf0395a95833b52d0542a9ce768b0cfef8f2ac851f84bed4735e7e5718
SHA5121ec9d7f35797803f937bcbd6b8307970fa2e1221a5609e92436e50861637bf6df2d6d90f74a6ebd85a329f3ffbaf4d601a7e9a6b3a53ca6b8edf53b1da862eea
-
Filesize
346KB
MD5e90e88ef8c53a4177011cab554f31e18
SHA1c38d6ea172011add51953c77303d5029b47d19b0
SHA256a33d8a383d59d4e1efba65f2fd59250384f9503d8cc2678c76f50f89aaae505d
SHA5127c794f7b1f43d0e0833729a68507269b2544a4fa8e46f899a6e3b37b2cb6fa44253b42869172db023196766091f52420b105a6b40f0898bb26f2b0665f67eb1d