223ed971b0f8cde12077dca84e042b1daea007486f26be254fec50e550184dd9

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
Size

111KB
MD5

fac0fd247605ecbbe57ee0e971524ce0
SHA1

c1400ceaec09cc45c6fc744cfb76c0b0fbbd5e36
SHA256

223ed971b0f8cde12077dca84e042b1daea007486f26be254fec50e550184dd9
SHA512

ac5e4eb6db0d6c7ce9fa5004e39fe6d3f44025737ec8cf5a5c25103b2ec2ce9ecac06d4992954b88002deef28964c5e1714d6c422b8e0b4d227d2c6d7793f956
SSDEEP

3072:duLDlObF/pstBaDqwONnct437Bl3N2Ux/1:M3lObF/p/uwONct43j92UV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	2232	WerFault.exe	86

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1"	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2232	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
2232	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
2232	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
2232	NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fac0fd247605ecbbe57ee0e971524ce0.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 2448
  2⤵
  - Program crash
  PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2232 -ip 2232
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads