2e2f0c3c49d85b19856a3da5f3ac2d5f795602700718b1c7cc498dbe534bcb62

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
Size

704KB
MD5

0d954ac0aaf97cc9ec844feaf137787c
SHA1

ea2f653543fb4161d61272f7cd1ef6b1e47c4705
SHA256

2e2f0c3c49d85b19856a3da5f3ac2d5f795602700718b1c7cc498dbe534bcb62
SHA512

6a5abb9b9422b433f29a7a37d7b26cda6eac0f0969af4185587006a39c160bec916bafba7071f7546a1048ab6eab35c9fa75169ecc7e525ba2419aa0013cfd69
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjmHzW9hUd56JsuBSjwGPmO12i1Dzbw:Hha8iAx+1zwjmHd6vB/jO11zbA

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
File created	C:\Windows\SysWOW64\GAAG.exe	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0d954ac0aaf97cc9ec844feaf137787c.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
714KB

MD5
374b5daedfca9c11e4ab23fda8206d1c

SHA1
0fe7f184c378afac2688477ff2b24a792eb86bb0

SHA256
687f4a70d22ccb33b37553f5acb7be4d843429b5fbfbd00d6a18ff8bb959b4e9

SHA512
77aae5f6a47c4ca46adc1d81cad104bf495e40595242b13ac8d7a27efa2233e355fa96cb1cb492dcc1606e621bced5423bcd3cc8e395575856072d1795e17f65

Download Submit
memory/2888-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2888-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads