0f7f31222f0511c667259b5da81431b555e643829a7d1d05e9d0a02810c2bf02 | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:27

Sharing

Report Analysis Logs

General

Target

NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe
Size

148KB
MD5

bfa3cfbbe5bd9847116d08327bdf02b0
SHA1

5495ad6db00be8b988609dc28109bbd114698f78
SHA256

0f7f31222f0511c667259b5da81431b555e643829a7d1d05e9d0a02810c2bf02
SHA512

2d5f2b8713cb5b95f75624ae788e1111f6833236352f3797dcdf7e0a8e853a978be849da1c7976f7578dc28c045cb2df5ddc1f11fbad5c71290681bcb0b23024
SSDEEP

3072:vu5PDykjCqw2hyNK7D6zd43+P+kdMTe+Em:vpE

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bfa3cfbbe5bd9847116d08327bdf02b0.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads