87a429b679869ce3fe14d11e2d64b76e5ff338e69557c5ed6e18d30b80ac595d

Analysis

max time kernel
160s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Size

398KB
MD5

53cb4f2be770c83bd603a3cace70c040
SHA1

1b52ad9e35b9dd03a83e4180fde33868c514204b
SHA256

87a429b679869ce3fe14d11e2d64b76e5ff338e69557c5ed6e18d30b80ac595d
SHA512

947e968bbfa1aeba61680aadec60243545cf46da1819665d252854799d8667c4ca55a313fb4a504ed42ce3ce3f09a8dfded35d3be06e805cbc097ea89d65bce2
SSDEEP

6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2144	NFDD.EXE

Loads dropped DLL 2 IoCs

pid	Process
1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NFDD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\XRVAOQL.EXE \"%1\" %*"	NFDD.EXE

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x0008000000015eb2-10.dat	upx
behavioral1/memory/1744-26-0x0000000000390000-0x00000000003FE000-memory.dmp	upx
behavioral1/files/0x00060000000120e4-20.dat	upx
behavioral1/files/0x00060000000120e4-22.dat	upx
behavioral1/files/0x00060000000120e4-27.dat	upx
behavioral1/memory/1744-30-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-29-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-32-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-33-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x00060000000120e4-34.dat	upx
behavioral1/memory/2144-35-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-39-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-40-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-41-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-42-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-43-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-44-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-45-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-46-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-47-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-48-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-49-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-50-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTVPESG.EXE = "C:\\Windows\\NTVPESG.EXE"	NEAS.53cb4f2be770c83bd603a3cace70c040.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\H:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\T:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\U:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\H:	NFDD.EXE
File opened (read-only)	\??\L:	NFDD.EXE
File opened (read-only)	\??\O:	NFDD.EXE
File opened (read-only)	\??\Q:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\E:	NFDD.EXE
File opened (read-only)	\??\N:	NFDD.EXE
File opened (read-only)	\??\R:	NFDD.EXE
File opened (read-only)	\??\S:	NFDD.EXE
File opened (read-only)	\??\M:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\P:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\Q:	NFDD.EXE
File opened (read-only)	\??\T:	NFDD.EXE
File opened (read-only)	\??\I:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\K:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\N:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\O:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\V:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\L:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\G:	NFDD.EXE
File opened (read-only)	\??\J:	NFDD.EXE
File opened (read-only)	\??\P:	NFDD.EXE
File opened (read-only)	\??\V:	NFDD.EXE
File opened (read-only)	\??\R:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\I:	NFDD.EXE
File opened (read-only)	\??\K:	NFDD.EXE
File opened (read-only)	\??\U:	NFDD.EXE
File opened (read-only)	\??\E:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\J:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\S:	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened (read-only)	\??\M:	NFDD.EXE

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\NFDD.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File created	C:\Program Files (x86)\GHSFV.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened for modification	C:\Program Files (x86)\GHSFV.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\USGNVGV.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File created	C:\Windows\UERFDPT.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File created	C:\Windows\NTVPESG.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
File opened for modification	C:\Windows\NTVPESG.EXE	NEAS.53cb4f2be770c83bd603a3cace70c040.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Program Files (x86)\\GHSFV.EXE \"%1\""	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Windows\\NTVPESG.EXE %1"	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\NTVPESG.EXE \"%1\" %*"	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\UERFDPT.EXE %1"	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\NTVPESG.EXE \"%1\""	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\XRVAOQL.EXE \"%1\" %*"	NFDD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Program Files (x86)\\GHSFV.EXE %1"	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	NEAS.53cb4f2be770c83bd603a3cace70c040.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NFDD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	NFDD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2144	1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe	27
PID 1744 wrote to memory of 2144	1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe	27
PID 1744 wrote to memory of 2144	1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe	27
PID 1744 wrote to memory of 2144	1744	NEAS.53cb4f2be770c83bd603a3cace70c040.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.53cb4f2be770c83bd603a3cace70c040.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.53cb4f2be770c83bd603a3cace70c040.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files\NFDD.EXE
  "C:\Program Files\NFDD.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GHSFV.EXE

Filesize
399KB

MD5
0f42c570c743fc8b54ea7d4ed463129f

SHA1
2d1eff4e7071573c0d9d89b7fc1722dd96ab4406

SHA256
50cbe11f649c116bcb810165b25438044981a0ffb133c716c1fcfb83c73724c3

SHA512
119c121598d8c47b9e401e4a19155a377805353112d6551b93b7ac4e96e5607f3861a99ec5d4798b3a1889bea7a47ba92439213081deb6952e661cc504d5bb65

Download Submit
C:\Program Files\NFDD.EXE

Filesize
399KB

MD5
1e16f4a05eaa3af54308c41c6a6eef04

SHA1
b2c273d58211938e367cb317f9016b92c95854bb

SHA256
17cb365ab1066625dbbe49f11555948ef083fad999ecc61d7c5ea720f6163ec1

SHA512
8bb88ec9fb8f0e058124c44aa562f39143a292fd615ea24b26262cf830f707b2deef33f358e450195e2d749981043f10b12efd56405a88cd12633a2be63597f8

Download Submit
C:\Program Files\NFDD.EXE

Filesize
399KB

MD5
1e16f4a05eaa3af54308c41c6a6eef04

SHA1
b2c273d58211938e367cb317f9016b92c95854bb

SHA256
17cb365ab1066625dbbe49f11555948ef083fad999ecc61d7c5ea720f6163ec1

SHA512
8bb88ec9fb8f0e058124c44aa562f39143a292fd615ea24b26262cf830f707b2deef33f358e450195e2d749981043f10b12efd56405a88cd12633a2be63597f8

Download Submit
C:\filedebug

Filesize
239B

MD5
b106fb5d58aa709bd2d1fe02d6c77d46

SHA1
80d0074ef2c33369938d5a258ccd91cfec981d9a

SHA256
d846512e49b0f9736c4cbedcb6f2c94bd696989e66c061bf38e9f97ed18810df

SHA512
d5ecf08163e87088d0495c2207bd3aeb9f1aac6ffdd1bcd6456596f3a69ff6c60f898ccb4077e65ac02f2ec7f04163b0953821355497b5318bdc1f20401f7eff

Download Submit
\??\c:\filedebug

Filesize
239B

MD5
b106fb5d58aa709bd2d1fe02d6c77d46

SHA1
80d0074ef2c33369938d5a258ccd91cfec981d9a

SHA256
d846512e49b0f9736c4cbedcb6f2c94bd696989e66c061bf38e9f97ed18810df

SHA512
d5ecf08163e87088d0495c2207bd3aeb9f1aac6ffdd1bcd6456596f3a69ff6c60f898ccb4077e65ac02f2ec7f04163b0953821355497b5318bdc1f20401f7eff

Download Submit
\Program Files\NFDD.EXE

Filesize
399KB

MD5
1e16f4a05eaa3af54308c41c6a6eef04

SHA1
b2c273d58211938e367cb317f9016b92c95854bb

SHA256
17cb365ab1066625dbbe49f11555948ef083fad999ecc61d7c5ea720f6163ec1

SHA512
8bb88ec9fb8f0e058124c44aa562f39143a292fd615ea24b26262cf830f707b2deef33f358e450195e2d749981043f10b12efd56405a88cd12633a2be63597f8

Download Submit
\Program Files\NFDD.EXE

Filesize
399KB

MD5
1e16f4a05eaa3af54308c41c6a6eef04

SHA1
b2c273d58211938e367cb317f9016b92c95854bb

SHA256
17cb365ab1066625dbbe49f11555948ef083fad999ecc61d7c5ea720f6163ec1

SHA512
8bb88ec9fb8f0e058124c44aa562f39143a292fd615ea24b26262cf830f707b2deef33f358e450195e2d749981043f10b12efd56405a88cd12633a2be63597f8

Download Submit
memory/1744-28-0x0000000000390000-0x00000000003FE000-memory.dmp

Filesize
440KB

Download
memory/1744-26-0x0000000000390000-0x00000000003FE000-memory.dmp

Filesize
440KB

Download
memory/1744-30-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1744-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1744-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2144-40-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-43-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-32-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-35-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-31-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2144-39-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-29-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-41-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-42-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-33-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-44-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-45-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-46-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-47-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-48-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-49-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-50-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads