Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 18:34
Behavioral task
behavioral1
Sample
NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe
Resource
win7-20230831-en
windows7-x64
General
-
Target
NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe
-
Size
346KB
-
MD5
ba72c9dd5c3d990694f649cc05a6e600
-
SHA1
8534bb52562c6b4e7ff74177417ec4d4573a997b
-
SHA256
7eff9b799b863a8bb62da7255df327e8d0b9b025ecbe67670598318f23e2e1c8
-
SHA512
1f9e9f1ee055eb2f9d52b51bda62045f7672781f79b3903604dceaf42d410d3e3b018f5aaa94c30aa36f61f3c71b9588fecd80872740070fdcccf5af49ef1f46
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+G:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4G
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3740 svhost.exe -
resource yara_rule behavioral2/memory/4868-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000200000002281a-3.dat upx behavioral2/files/0x000200000002281a-4.dat upx behavioral2/memory/3740-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000700000002326c-104.dat upx behavioral2/memory/4868-167-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/3740-267-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4868-167-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/3740-267-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3740 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe 3740 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3740 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 83 PID 4868 wrote to memory of 3740 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 83 PID 4868 wrote to memory of 3740 4868 NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ba72c9dd5c3d990694f649cc05a6e600.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
346KB
MD5f226db1a5d33782a3c8b4adb46ab447a
SHA1e8ceef8b5192636a7254f896eda640c313a2f6bb
SHA256959b6559ee68125d2f43502990988e4fb67d1570d631248578a97cccc528df67
SHA5122a0ed999539ea76549796ead29ce000709d18e074328bb122c8a8d3d85f31fd3c5ba4d4e07d14a625122428919ba0a1c8c2467c1d71c9d9cd109e467540fed64
-
Filesize
346KB
MD5f226db1a5d33782a3c8b4adb46ab447a
SHA1e8ceef8b5192636a7254f896eda640c313a2f6bb
SHA256959b6559ee68125d2f43502990988e4fb67d1570d631248578a97cccc528df67
SHA5122a0ed999539ea76549796ead29ce000709d18e074328bb122c8a8d3d85f31fd3c5ba4d4e07d14a625122428919ba0a1c8c2467c1d71c9d9cd109e467540fed64
-
Filesize
346KB
MD5a4cebf88aee2d86f9ebf59241121730a
SHA1028db36f7a03275b384e27e3b98e56fd8186090d
SHA2568292b13504f89b4cc3786995aaf3f20bc4d3f1f721f52205dc9640f8cd4ea03c
SHA512beac16e00ed78c05ea688431072c79d7841a018e6e0fa38d3af3c5a9b306689e9cec50262105b7028fcc9383ce02803d4c39cfc12ecb5c62cfa07f72e42f78d5