cf7e65258a8dca60722fcc4a508d0aa6a4841294e48878e956d2c6c5ff6224e1

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe
Size

112KB
MD5

2eefe5b91752cbd7afc8ca535d6376c0
SHA1

5332d95f0b76e2c4f5d7c9a185b1e9851e95e781
SHA256

cf7e65258a8dca60722fcc4a508d0aa6a4841294e48878e956d2c6c5ff6224e1
SHA512

897a1640fdfa74cbeecaabe4d8396b2a5d7739d499e9fd66a0e7e60df6cae2052c97fbb5fd0305cdd5c1054d6c9a45c4e0570b7f30d59ea3f6a6f76ca91819c6
SSDEEP

1536:giL6JIy7lnx5IMXbyRevJ2V1+YSbmAisKldRj0HCqqmTw8FmygLr4gSisKldR:giLKIEn7byReYVvSb8VIHnqwFm5EAV

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2208	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	28
PID 2188 wrote to memory of 2208	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	28
PID 2188 wrote to memory of 2208	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	28
PID 2188 wrote to memory of 2208	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	28
PID 2188 wrote to memory of 1260	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	16
PID 2188 wrote to memory of 1260	2188	NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2eefe5b91752cbd7afc8ca535d6376c0.exe"
    3⤵
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-3-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/1260-4-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/2188-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2188-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2208-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads