90d3772db1b4414bedc912ac4001593a86d1b1f0d8d38cc037e5892f25a90628

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe
Size

235KB
MD5

e0ae5df1efe84b8fe966333a2d501f40
SHA1

c94c76a103014399256be81a32d04e663f6b17e8
SHA256

90d3772db1b4414bedc912ac4001593a86d1b1f0d8d38cc037e5892f25a90628
SHA512

f7e8c8d2d7d8a1d8c9bb3646dcf153d91ea8dae2158dcf61e8554cc2dc1a868b0796106b87e34bbbbc3668befece187bbce76fc636b29dbe2322eb9e34b91763
SSDEEP

6144:OYngNOiTX2p1+XqaVbi3hVq8n8wdeIpjlsRJCK/:OYnIBKsXqc0Pn8fIpOP/

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\Control Panel\International\Geo\Nation	NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000_Classes\Local Settings	NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1604	4288	NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe	85
PID 4288 wrote to memory of 1604	4288	NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e0ae5df1efe84b8fe966333a2d501f40.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Twitch.vbs"
  2⤵
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Twitch.vbs

Filesize
1KB

MD5
302d3f5fc02e93b72ca9ef6c99af8e48

SHA1
093fb93146b908b8f7ca5b4647d211f6a644256c

SHA256
b601169face77962c3cc77cf3567f5751311ebc2f61779ac29cd1ab82acee52c

SHA512
3ba83ff781003ed8d1d58a4cf267882c64fac5017ce9710b2a60c5a3236fce9c2c790203b1dbc1eb2e2cd3cb470a2cc98acc05a52ef737cd74e535104ee7054c

Download Submit