11d4b9663bb6b1eae21b9d8f8500213e0f2bf0c9ee636a52e144915915b8995a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f5852497e87b7eda68d52228a8601470.exe
Size

148KB
MD5

f5852497e87b7eda68d52228a8601470
SHA1

e804abf699b17a846fb55a85ee7a7605e18045f2
SHA256

11d4b9663bb6b1eae21b9d8f8500213e0f2bf0c9ee636a52e144915915b8995a
SHA512

43a008cf7a09a4eee926108a2b282f85a2886e9fdf04f4bf8a25956e78e075885f4b04c2e3aa83ecb10af874a527d1e1da8017587c6bf137c218927f00271f96
SSDEEP

3072:0qRVmxZC7r6alfFAuoMSjuJsLL0MD2UAO8GNpE9IkN9eKp:0qRVmO7r6alfFAuopuGa7GNy9Ik/n

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2916-73-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	NEAS.f5852497e87b7eda68d52228a8601470.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2916	NEAS.f5852497e87b7eda68d52228a8601470.exe
2916	NEAS.f5852497e87b7eda68d52228a8601470.exe
2916	NEAS.f5852497e87b7eda68d52228a8601470.exe
2916	NEAS.f5852497e87b7eda68d52228a8601470.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f5852497e87b7eda68d52228a8601470.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f5852497e87b7eda68d52228a8601470.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FinePlus.ini

Filesize
860B

MD5
ac127a2e3f2f2b74724f1e066413e059

SHA1
edcf79a0ce40e093448756136a35349b45a4b848

SHA256
442d543fde3f0f1ce86f064be8b213ae3741f1924c1613c32c568db7f7875273

SHA512
3c8af67d8e3ef330241de4b29efedcfb4192f7e38c4a5916666d8c81766389bd45324c8f5c63cc4d7f46e16a288573da55195234fa4a602a0d225fb4ed42d51e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FinePlus.ini

Filesize
1KB

MD5
4cd8bf1eb998e623c220ab2c1e20334d

SHA1
74e542e65c2f13cb91172fad02d9e8cb2f84a744

SHA256
bf08a9b11d49f86f4d13380b4f73171f9a9bff3a9bd3054daee8d457be219597

SHA512
11fa218f767b0b8b810c18b015d48b5d85d25f24aae13b60e5c41a99a713cb06481d486f492fb369c05f4ffc55737ebe83a17f2967af4988f59189756edbca3e

Download Submit
memory/2916-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2916-73-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download