Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 19:56
Behavioral task
behavioral1
Sample
NEAS.792b557188f4c723cbc9333066fb3000.exe
Resource
win7-20231020-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.792b557188f4c723cbc9333066fb3000.exe
Resource
win10v2004-20231020-en
6 signatures
150 seconds
General
-
Target
NEAS.792b557188f4c723cbc9333066fb3000.exe
-
Size
45KB
-
MD5
792b557188f4c723cbc9333066fb3000
-
SHA1
3a01a5073dfe3d02a4e6e0fbb39db93fe29c8749
-
SHA256
a134058e4b8a9c17d3b92b680894f5128a3fb3e05fb2e5e2474e81fa82e44e49
-
SHA512
c9fe0661f492e406ae6fb3f503a411c6f4abc1860c848f01aaa88f160db0cdd641b0ba92c81d9d876c85593a0039a95fab81c553be3f20b1bc8a399ea5c4aad9
-
SSDEEP
768:ehP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:ysWE9N5dFu53dsniQaB/xZ14n7zIF+qr
Score
10/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Run\9D7A8D75 = "C:\\Users\\Admin\\AppData\\Roaming\\9D7A8D75\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe 2768 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1260 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2768 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2768 2924 NEAS.792b557188f4c723cbc9333066fb3000.exe 29 PID 2924 wrote to memory of 2768 2924 NEAS.792b557188f4c723cbc9333066fb3000.exe 29 PID 2924 wrote to memory of 2768 2924 NEAS.792b557188f4c723cbc9333066fb3000.exe 29 PID 2924 wrote to memory of 2768 2924 NEAS.792b557188f4c723cbc9333066fb3000.exe 29 PID 2924 wrote to memory of 2768 2924 NEAS.792b557188f4c723cbc9333066fb3000.exe 29 PID 2768 wrote to memory of 1260 2768 winver.exe 16 PID 2768 wrote to memory of 1124 2768 winver.exe 18 PID 2768 wrote to memory of 1216 2768 winver.exe 17 PID 2768 wrote to memory of 1260 2768 winver.exe 16
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\NEAS.792b557188f4c723cbc9333066fb3000.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.792b557188f4c723cbc9333066fb3000.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2768
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1216
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124