Analysis
- max time kernel
129s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2023, 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe
Resource
win7-20231020-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe
- Size 80KB
- Sample231024-adlsgshb6w
- SHA256 4731acfb796fc4170b5399407e136a373988aa50426720bb39f1812d21538365
- MD5 704f15ac6527fc797c3a8d8fd1475310
- SHA1 ec8c2334c53b660880b84b137e11efa776e08441
- SHA512 8d27fa97914db77824ec35c960f8569d755739f90b6b03d7f31ccb310a2d051ca7f985fbe2c4ffc5f15edc8127da43f8658fb3228fb2a4de1140bce9ea9f34ac
- SSDEEP 1536:9asQx7dBLwhrkISRd2u+nlB2p8yBVejX1eYS:9a4kvd2uA/A7BVejXMYS
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation WgaDisp.exe Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe - Executes dropped EXE 1 IoCs
pid Process 1116 WgaDisp.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\_WGA = "C:\\Windows\\WgaDisp.exe" NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WgaDisp.exe NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4202093053" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000006e394f3f3e6df565f4c283a4abf3e938a14cd3b2c9f33e81d6598fb64ec766e4000000000e80000000020000200000001c64a2e6e19e8fb808e75aabcde896e0c49bf28af8e83606123b00ad0c229a785000000059dfea73b19b1d35d147bdcfa36a169482d12f2f4e106fa9be89a79e16d05af59626ba82bee6f1ec310ef68b804660ebeb8c1096d31945495b53bfb2b56d3e81e85fdc113469e1a62be5417409b9f611400000009cec4a9571f4285c29cc28bcbc8fe6b725242bf9336d645f91c77a3113fba39b84196fe419ad06ccf65692b0528e7ffdec415f6eeb6806d29ceb912c7165dd87 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31065613" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000002537c7ccff32bd5848c2414b0cc63671232f9f7f2b229d7603243af977f063ec000000000e8000000002000020000000502383b2d25d52c263f1c2caf527e065da6a475e9f7b1bf0c1260b4431474ce4500000008872cc36ac77bee3a7423f0ea2b2ef5b03b37463953cfd30f198db6460f530f7f0f1efa9d81073ceb48ec8efa43a6e9d04efd423783419563502e72cf7c2678e7dc4c42550fa2d4c7a5ee5d2bbddca5140000000d1562da5aa7e4f48e4fb0429cbc8c31d689fb91bdab177c1c5c513dbb43e0e56a1937ce6eb318478d148723f5230527cd6998e85ddf7349852a62d1ee51780a9 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c470000000002000000000010660000000100002000000060e0dcc4aa6205cf4d1ea47d82f057ff7e71f5d437281f3399c8f1957ad15ed3000000000e8000000002000020000000f0825ef2b2683d67dfbf3d1e91573b7e6480ebc72cdda12af9ed416cd6aa988c20000000bd5f6df284e94c3c8e27201f09efd6eb67ffb4196e0e8bdb4c751b754826835140000000745d6814c314d5753c3cc1525bb9387aca30335139452f6bfe2e3b9c4a49333bed18876c46b2c5904a4a86cf6a93d3e830cab8aca60dec092b4cfa1d8f9f043d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d081effb0d06da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1043d5fb0d06da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{25EE528A-7201-11EE-91E2-5A18E6D98FED} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31065613" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31065613" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4202719017" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000001248b07466ab4a19505445258869cd5084adc886391cfdb9fe7d63dd3ac8433f000000000e80000000020000200000001cb764b4312480c67dc3099eb5782f5565af2b759355b0e8062d3aedcb0fc0c31000000095268c7c1c0e02d790d840e75c0d8eb4400000000b2f74c5329a1cfd6a7aefdd172c069720c1faf35c148de49da2c8ff26be5d00d3a8bf95b6c67de114771a7baa99371e60828b94cea64d95d89d4b3065927159 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4202719017" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31065613" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{26088BC9-7201-11EE-91E2-5A18E6D98FED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000002dac438293db8878d2ee87a4314d6a42a36f80a2f338965dc5c45392fc01790d000000000e8000000002000020000000987511943ca89f780bb87ce7df29f7817dcdab7ad3d3ccea0c8b200b7b902abd100000001be7d008abb31f6eab8845f496622b66400000003a5954d744028d57dd5133e1ef280ba56cb464567e4246375e1488d1d8247fae89087ec9a2924b5f3865056855082f7908322b28ee6597ea0135350419318703 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe - Suspicious behavior: LoadsDriver 18 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 672 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1400 iexplore.exe 3580 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3580 iexplore.exe 3580 iexplore.exe 1400 iexplore.exe 1400 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4536 wrote to memory of 1400 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 89 PID 4536 wrote to memory of 1400 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 89 PID 4536 wrote to memory of 1116 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 90 PID 4536 wrote to memory of 1116 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 90 PID 4536 wrote to memory of 1116 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 90 PID 1116 wrote to memory of 3580 1116 WgaDisp.exe 91 PID 1116 wrote to memory of 3580 1116 WgaDisp.exe 91 PID 4536 wrote to memory of 4768 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 92 PID 4536 wrote to memory of 4768 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 92 PID 4536 wrote to memory of 4768 4536 NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe 92 PID 3580 wrote to memory of 4824 3580 iexplore.exe 95 PID 3580 wrote to memory of 4824 3580 iexplore.exe 95 PID 3580 wrote to memory of 4824 3580 iexplore.exe 95 PID 1400 wrote to memory of 1620 1400 iexplore.exe 96 PID 1400 wrote to memory of 1620 1400 iexplore.exe 96 PID 1400 wrote to memory of 1620 1400 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.704f15ac6527fc797c3a8d8fd1475310_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.thesexsquare.com/2/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
-
C:\Windows\WgaDisp.exe"C:\Windows\WgaDisp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.thesexsquare.com/2/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_DelItH.bat" "2⤵PID:4768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25EE528A-7201-11EE-91E2-5A18E6D98FED}.dat
- Size 4KB
- SHA256 bfa14f224a3c9548daf2671521bd14a9be4a1d1e80e95bee2691a402e58637cd
- MD5 a879f6585650c5f5306eb38585c140ab
- SHA1 937ed1aa5aad788b814e4363d81527e1c2fc0487
- SHA512 e83f8f722ac504b1d102a23e2ed183ea4bc547bdf531dedc49712aa7350a9c184d48f342bc1371830bb894c00af09cecf1a4c8c2def444c98e57eef2a740561e
- SSDEEP 12:rlfFqrEgm8Gj76FSDrEgmf+IaCyoqw9lTqK8CgUC9lTqK8Cgwnf:r2G8eGv/99lWOC9lW6f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26088BC9-7201-11EE-91E2-5A18E6D98FED}.dat
- Size 5KB
- SHA256 684c2ae5a3a7cfe1a4c69990098499b35f495f3ee29821c0fc1a1c7291dafe92
- MD5 ad0d31a2e2fd1049ac5348de9bbf0426
- SHA1 3003e7cba435c39fbd02ba446079728c5e61974a
- SHA512 d42ea83bbefd01978803f82e0e61b165fc4ff3bde0e1dcbcae738362e073f8f2b46b4a8fb5a1619e5706a897116a6fef91d0b053b899eb688b45f723830b0d22
- SSDEEP 24:rfGo/QU8IjGo/48IN8I879lWHwlAH9lWHwlAGA:rfGo4UtGogTGCHsH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA9F7.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K1QHLR0H\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UDS0USIU\bWyuJTDeK[1].js
- Size 41KB
- SHA256 14af559420f90026cb00073ec59893748cf2d989b0592db705c10741e3886612
- MD5 ef1fccfb1cbe58869c01607a69e7b3df
- SHA1 d340a1dd727fbbcfba8998ed9ddd16ff92b8ba82
- SHA512 f2ba62e7ffc0e75cef0e8f1a4a8ea897c0c595adc4ee725518765ea319eb8971e5f2d1c7a2adae28d389b86c9ad160322a5f1225f8ca97bfffc1ca5c5b216b12
- SSDEEP 768:pDCocKMe6iIIKmLcafBLHVRfjQr2sUCnk6FVGgV9KoxZJ3EAKpnA9aDsN3OBJSFG:je+YnVGMxXEJBXrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Kno4BC9.tmp
- Size 88KB
- SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
- MD5 002d5646771d31d1e7c57990cc020150
- SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
- SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
- SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_DelItH.bat
- Size 247B
- SHA256 266b1a40c182c6bd84042d6663f01da77dffca496dad90f13703d8648a919603
- MD5 ff26684fdcbc338949163f392d703876
- SHA1 308b0b8b0a6eef650f9d415e18624062e356055c
- SHA512 7c06650c1702df5b431329c73a3e3dedfea97b77b2677476d88469a8c832943b3cc29d2093e6beea5b538ef6aaec930f3236382b6105609e4b285a601e64cafb
- MD5 SHA1 SHA512
- Path C:\Windows\WgaDisp.exe
- Size 80KB
- SHA256 f7f180aff5d7963ae852694bab026b869c21f5aa3571fa4f7f17fdae79ade412
- MD5 a5838bd91ebc62a983cf46ebc1c26540
- SHA1 6b2895412794336a2f6ded3988f0a901099a7509
- SHA512 d22c0b727ff6a52216ce3742346182fc6e38e5ee571440528b676d26070af45cbcff07a16191b82efaec68346c477f2daece3834c36110d7f4226a7b1cf1b4ba
- SSDEEP 1536:kasQx7dBLwhrkISRd2u+nlB2p8yBVejX1eYS:ka4kvd2uA/A7BVejXMYS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\WgaDisp.exe
- Size 80KB
- SHA256 f7f180aff5d7963ae852694bab026b869c21f5aa3571fa4f7f17fdae79ade412
- MD5 a5838bd91ebc62a983cf46ebc1c26540
- SHA1 6b2895412794336a2f6ded3988f0a901099a7509
- SHA512 d22c0b727ff6a52216ce3742346182fc6e38e5ee571440528b676d26070af45cbcff07a16191b82efaec68346c477f2daece3834c36110d7f4226a7b1cf1b4ba
- SSDEEP 1536:kasQx7dBLwhrkISRd2u+nlB2p8yBVejX1eYS:ka4kvd2uA/A7BVejXMYS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\WgaDisp.exe
- Size 80KB
- SHA256 f7f180aff5d7963ae852694bab026b869c21f5aa3571fa4f7f17fdae79ade412
- MD5 a5838bd91ebc62a983cf46ebc1c26540
- SHA1 6b2895412794336a2f6ded3988f0a901099a7509
- SHA512 d22c0b727ff6a52216ce3742346182fc6e38e5ee571440528b676d26070af45cbcff07a16191b82efaec68346c477f2daece3834c36110d7f4226a7b1cf1b4ba
- SSDEEP 1536:kasQx7dBLwhrkISRd2u+nlB2p8yBVejX1eYS:ka4kvd2uA/A7BVejXMYS
- MD5 SHA1 SHA512 SSDEEP