Analysis
-
max time kernel
7s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 19:56
Behavioral task
behavioral1
Sample
NEAS.792b557188f4c723cbc9333066fb3000.exe
Resource
win7-20231020-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.792b557188f4c723cbc9333066fb3000.exe
Resource
win10v2004-20231020-en
6 signatures
150 seconds
General
-
Target
NEAS.792b557188f4c723cbc9333066fb3000.exe
-
Size
45KB
-
MD5
792b557188f4c723cbc9333066fb3000
-
SHA1
3a01a5073dfe3d02a4e6e0fbb39db93fe29c8749
-
SHA256
a134058e4b8a9c17d3b92b680894f5128a3fb3e05fb2e5e2474e81fa82e44e49
-
SHA512
c9fe0661f492e406ae6fb3f503a411c6f4abc1860c848f01aaa88f160db0cdd641b0ba92c81d9d876c85593a0039a95fab81c553be3f20b1bc8a399ea5c4aad9
-
SSDEEP
768:ehP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:ysWE9N5dFu53dsniQaB/xZ14n7zIF+qr
Score
10/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1076-0-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FA3A4C35 = "C:\\Users\\Admin\\AppData\\Roaming\\FA3A4C35\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 724 winver.exe 724 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 724 winver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1076 wrote to memory of 724 1076 NEAS.792b557188f4c723cbc9333066fb3000.exe 87 PID 1076 wrote to memory of 724 1076 NEAS.792b557188f4c723cbc9333066fb3000.exe 87 PID 1076 wrote to memory of 724 1076 NEAS.792b557188f4c723cbc9333066fb3000.exe 87 PID 1076 wrote to memory of 724 1076 NEAS.792b557188f4c723cbc9333066fb3000.exe 87 PID 724 wrote to memory of 3220 724 winver.exe 72 PID 724 wrote to memory of 2380 724 winver.exe 41 PID 724 wrote to memory of 2396 724 winver.exe 42 PID 724 wrote to memory of 2516 724 winver.exe 83 PID 724 wrote to memory of 3220 724 winver.exe 72 PID 724 wrote to memory of 3472 724 winver.exe 71 PID 724 wrote to memory of 3708 724 winver.exe 70 PID 724 wrote to memory of 3872 724 winver.exe 69
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2396
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3872
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3472
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\NEAS.792b557188f4c723cbc9333066fb3000.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.792b557188f4c723cbc9333066fb3000.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:724
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2516