Analysis

  • max time kernel
    202s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 18:27

General

  • Target

    NEAS.882b0e3a6fa4f034d7b920a80fbf0c20.exe

  • Size

    2.6MB

  • MD5

    882b0e3a6fa4f034d7b920a80fbf0c20

  • SHA1

    09700a62c0848d82096e257615fc340fa7f2768f

  • SHA256

    78a78d59eebe09d08b4851b830317fa46f06f9ad78290d44dcb1f28fe805be79

  • SHA512

    aa685817eb309e6ce39ba7a032c4ec3b00ad6cf32271d7c6eb0b1f37fb4db380317a633f9a746557173c36828718aefefa35ff508a8ef03c9ba43c2ac8caed3a

  • SSDEEP

    49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/u:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/u

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.882b0e3a6fa4f034d7b920a80fbf0c20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.882b0e3a6fa4f034d7b920a80fbf0c20.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3768
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2308
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4940
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4752
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3248
            • \??\c:\windows\resources\themes\explorer.exe
              c:\windows\resources\themes\explorer.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetWindowsHookEx
              PID:4396
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetWindowsHookEx
        PID:3640
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetWindowsHookEx
        PID:4316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe

    Filesize

    2.6MB

    MD5

    b467c3c1a1b70578e9505ff4b0909078

    SHA1

    0a2b93bba61553b6f017de6c90619a59a36fdfd8

    SHA256

    3c61be9927c01710df4a0342e672d9a5dd0756fb4ec1464eef6ef388b8be04f2

    SHA512

    bc6398f052ef1eac73e30523359752ec35a3fe8e9288b871ef723fd520e9eb327a893b49f65310067c7423080d7ceecbceb4fe499a4388b1d449641dc89b315c

  • C:\Windows\Resources\Themes\explorer.exe

    Filesize

    2.6MB

    MD5

    b467c3c1a1b70578e9505ff4b0909078

    SHA1

    0a2b93bba61553b6f017de6c90619a59a36fdfd8

    SHA256

    3c61be9927c01710df4a0342e672d9a5dd0756fb4ec1464eef6ef388b8be04f2

    SHA512

    bc6398f052ef1eac73e30523359752ec35a3fe8e9288b871ef723fd520e9eb327a893b49f65310067c7423080d7ceecbceb4fe499a4388b1d449641dc89b315c

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • C:\Windows\Resources\svchost.exe

    Filesize

    2.6MB

    MD5

    2a2f6563221f9d9b8fe8ae7687c3d3e8

    SHA1

    827a94d7741f74e439f3590f00cedb668a8d08b8

    SHA256

    1fcdf52aee38a4253989383cd4860a756127e351d8f86861a00124f9a0840c82

    SHA512

    b721c5f69ddea18a7aef1693e8facd58a16b68f8c16528a8557b32c8457e78e37429e66ce001843ca2063458dd2202a5bb0e6324d65149f7ba1532da869ae144

  • \??\c:\windows\resources\spoolsv.exe

    Filesize

    2.6MB

    MD5

    685330b009fe0aabf15c7b9e41e14219

    SHA1

    60e7b593fd922b572b598ae197c82469b0e5b7e0

    SHA256

    6ffd5b28d0347f18ee641d4d2a6416792720ae927da12d51ce85de7196e2326e

    SHA512

    92ea61d759abfdb682dd12dd0acbb4745d1e4cbc2b59e50ed67e0cd431a08a99b3685d3f7ef76e56370c7ed53e46696c5cfbe0eaa9ec6c53a0b92ccbe7a0aef1

  • \??\c:\windows\resources\svchost.exe

    Filesize

    2.6MB

    MD5

    2a2f6563221f9d9b8fe8ae7687c3d3e8

    SHA1

    827a94d7741f74e439f3590f00cedb668a8d08b8

    SHA256

    1fcdf52aee38a4253989383cd4860a756127e351d8f86861a00124f9a0840c82

    SHA512

    b721c5f69ddea18a7aef1693e8facd58a16b68f8c16528a8557b32c8457e78e37429e66ce001843ca2063458dd2202a5bb0e6324d65149f7ba1532da869ae144

  • \??\c:\windows\resources\themes\explorer.exe

    Filesize

    2.6MB

    MD5

    b467c3c1a1b70578e9505ff4b0909078

    SHA1

    0a2b93bba61553b6f017de6c90619a59a36fdfd8

    SHA256

    3c61be9927c01710df4a0342e672d9a5dd0756fb4ec1464eef6ef388b8be04f2

    SHA512

    bc6398f052ef1eac73e30523359752ec35a3fe8e9288b871ef723fd520e9eb327a893b49f65310067c7423080d7ceecbceb4fe499a4388b1d449641dc89b315c

  • memory/2308-29-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/2308-92-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-90-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-28-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-67-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-15-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/2308-31-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-51-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-36-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/2308-88-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3248-82-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3248-77-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3248-78-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/3640-66-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/3640-57-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3640-46-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-47-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-34-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-4-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-27-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-9-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/3768-59-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-3-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/3768-7-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-1-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/3768-0-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4316-65-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4316-60-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4316-87-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4396-84-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4396-83-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4396-81-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-89-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-72-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4752-68-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-91-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-93-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-86-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4940-40-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4940-61-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4940-55-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4940-24-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4940-33-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

  • memory/4940-32-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB

  • memory/4940-30-0x0000000000400000-0x0000000000D51000-memory.dmp

    Filesize

    9.3MB