f99c428437782768906e67eb3f85817513c83fc504d6145fac32326a022cf4ec

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe
Size

117KB
MD5

63b30c9b43dbf2d523421350bfec0cd0
SHA1

a1d508b33f18675a36f8d3a93991b5e4a8a988b9
SHA256

f99c428437782768906e67eb3f85817513c83fc504d6145fac32326a022cf4ec
SHA512

6bd7cebb489294e66a34cfb07982b34e36b0dcb20fc9dfc5c31f1ce2cc8c8c15c61171ae7c94aaec504c6e9a0e213fc4d47e18c42afc6e080967393ea95a4f8a
SSDEEP

3072:OE9j8b3ZXgKC1hX//iASOXRJzDOD26j/3Dc3p:OEebiKuX//iZOXRJ3OD26j8p

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
1120	smss.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Service.exe	smss.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3980	sc.exe
4448	sc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe
1120	smss.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3980	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	90
PID 2068 wrote to memory of 3980	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	90
PID 2068 wrote to memory of 3980	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	90
PID 2068 wrote to memory of 1120	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	92
PID 2068 wrote to memory of 1120	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	92
PID 2068 wrote to memory of 1120	2068	NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe	92
PID 1120 wrote to memory of 4448	1120	smss.exe	93
PID 1120 wrote to memory of 4448	1120	smss.exe	93
PID 1120 wrote to memory of 4448	1120	smss.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.63b30c9b43dbf2d523421350bfec0cd0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe stop wscsvc
  2⤵
  - Launches sc.exe
  PID:3980
- C:\Windows\SysWOW64\1230\smss.exe
  C:\Windows\system32\1230\smss.exe -d
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe stop wscsvc
    3⤵
    - Launches sc.exe
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1230\smss.exe

Filesize
117KB

MD5
e593ac18d8cdc09a1b4b200f3ed3795d

SHA1
b07eb6a4ddb82eb2da6c1ea419092c9bc3ceecc2

SHA256
99641515ad28eda3dcde791b568e9750ae6c50984ba565b6828db2cf72e542f2

SHA512
713a77321d807c26fc0cfdc2f8163020f36bddb85383de142484de21e226ae09cae7a4497c9433e215828599214038572202216b4feef195362dd81740d5addb

Download Submit
C:\Windows\SysWOW64\1230\smss.exe

Filesize
117KB

MD5
e593ac18d8cdc09a1b4b200f3ed3795d

SHA1
b07eb6a4ddb82eb2da6c1ea419092c9bc3ceecc2

SHA256
99641515ad28eda3dcde791b568e9750ae6c50984ba565b6828db2cf72e542f2

SHA512
713a77321d807c26fc0cfdc2f8163020f36bddb85383de142484de21e226ae09cae7a4497c9433e215828599214038572202216b4feef195362dd81740d5addb

Download Submit
memory/2068-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download