b58953ce92c3d636ab9cfda2db03df57e6da0c197c5f73a2d525944a312684f0

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
Size

3.9MB
MD5

df52b0044962ab2f4ae8127cacac2ec0
SHA1

2c5fe7ad4a65f31f517bf3e3d534df7eda6d1bd2
SHA256

b58953ce92c3d636ab9cfda2db03df57e6da0c197c5f73a2d525944a312684f0
SHA512

bd330283f1bded90d7529ea3317bffc014038cd445bb60b12a7f05d3e975f7673aa6505578cb622153d596388853b9507c89f01be427f3b1b6dd1326cbda77af
SSDEEP

98304:HW+9NsoLiEzCeMjXeDe7Sq50m7Mnm2q8OXA4E0LI:HWRg99DemRmAxq8Ow4a

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2500-0-0x0000000000400000-0x000000000083E000-memory.dmp	upx
behavioral1/memory/2500-3-0x0000000000400000-0x000000000083E000-memory.dmp	upx
behavioral1/memory/2500-7-0x0000000000400000-0x000000000083E000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\stgz.scr	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
File created	C:\Windows\stgz.scr	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
File created	C:\Windows\ssunstl.exe	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Control Panel\Desktop	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\stgz.scr"	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Control Panel\Desktop\ScreenSaveActive = "1"	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2292	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2292	2500	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe	28
PID 2500 wrote to memory of 2292	2500	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe	28
PID 2500 wrote to memory of 2292	2500	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe	28
PID 2500 wrote to memory of 2292	2500	NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.df52b0044962ab2f4ae8127cacac2ec0_JC.exe"
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\readme.txt

Filesize
42B

MD5
4826718f8ce35f325997a15f286e0fbf

SHA1
4cd2b908fbe14ead068bbde99f78af447025ea84

SHA256
421d19ec8dd092b74637756df1a69143f764c6542db5dd06a10e5ac6da196d42

SHA512
34a47a7d72dbd3dde52211d42b70b739f4faf767fbd7eb498d2c901433265dbce6cd7ad01e140e8a7166fa327fd7c06a6a4b3b5b74edf5d0eae62afa783a655b

Download Submit
memory/2500-0-0x0000000000400000-0x000000000083E000-memory.dmp

Filesize
4.2MB

Download
memory/2500-3-0x0000000000400000-0x000000000083E000-memory.dmp

Filesize
4.2MB

Download
memory/2500-7-0x0000000000400000-0x000000000083E000-memory.dmp

Filesize
4.2MB

Download