General
-
Target
NEAS.bd7756138f48dc4ec8088e23ef6a4c80.exe
-
Size
56KB
-
Sample
231024-y86yxahh91
-
MD5
bd7756138f48dc4ec8088e23ef6a4c80
-
SHA1
9a2387553eb58d992692d2e61e57c3caa5ea262a
-
SHA256
102844e3e91b3f8d97588fc1571ac5f0e603d3942cbccfcb64f3bd25e34b0c66
-
SHA512
9e1689c9d60815d110ed2fb307c17a90f2ec208687136d926416bb0254ec7461cf0120360c68dac8f34f8ed2b36a7ec66b3c30212a73b4662323c8eaf2f4fac2
-
SSDEEP
768:AvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EYRnenrABc:CNeRBl5PT/rx1mzwRMSTdLpJYYs
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bd7756138f48dc4ec8088e23ef6a4c80.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.bd7756138f48dc4ec8088e23ef6a4c80.exe
Resource
win10v2004-20231023-en
Malware Config
Targets
-
-
Target
NEAS.bd7756138f48dc4ec8088e23ef6a4c80.exe
-
Size
56KB
-
MD5
bd7756138f48dc4ec8088e23ef6a4c80
-
SHA1
9a2387553eb58d992692d2e61e57c3caa5ea262a
-
SHA256
102844e3e91b3f8d97588fc1571ac5f0e603d3942cbccfcb64f3bd25e34b0c66
-
SHA512
9e1689c9d60815d110ed2fb307c17a90f2ec208687136d926416bb0254ec7461cf0120360c68dac8f34f8ed2b36a7ec66b3c30212a73b4662323c8eaf2f4fac2
-
SSDEEP
768:AvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EYRnenrABc:CNeRBl5PT/rx1mzwRMSTdLpJYYs
Score10/10-
Modifies boot configuration data using bcdedit
-
Renames multiple (268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (53) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1