599350bc6e97dbc4e03b01f76704e5316369712a95e31d8dcd829d9486230109

Analysis

max time kernel
150s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
Size

204KB
MD5

f4414af47921d04cda893e807bf0ddb0
SHA1

f23b71cbdb3b9a2f67bb9a86aa0cf6623911466d
SHA256

599350bc6e97dbc4e03b01f76704e5316369712a95e31d8dcd829d9486230109
SHA512

6052ab09298e9cb97575e86a888cca47b2824e06dd6815db481a6747844c52aaaeb27a3e251f71e1eab81aa7dd978d4cb8c98038acaf86ec46b907a54b91c5e0
SSDEEP

3072:HmbW810tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWi9:Gqa4QxL7B9W0c1RCzR/fSmlF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vooliv.exe

Executes dropped EXE 1 IoCs

pid	Process
2140	vooliv.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /n"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /j"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /x"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /u"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /l"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /y"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /q"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /m"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /p"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /j"	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /a"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /g"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /r"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /o"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /s"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /e"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /i"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /v"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /t"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /k"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /b"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /f"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /z"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /c"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /d"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /h"	vooliv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\vooliv = "C:\\Users\\Admin\\vooliv.exe /w"	vooliv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe
2140	vooliv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
2140	vooliv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2140	2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe	28
PID 2152 wrote to memory of 2140	2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe	28
PID 2152 wrote to memory of 2140	2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe	28
PID 2152 wrote to memory of 2140	2152	NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f4414af47921d04cda893e807bf0ddb0_JC.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\vooliv.exe
  "C:\Users\Admin\vooliv.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\vooliv.exe

Filesize
204KB

MD5
1443e1341485ba5fd7ff59e40a07fbca

SHA1
0b47da18e16a95f0ec75100feb2e27bb1f71e45d

SHA256
cd32ed5ea1592a20ce8116ca3ee5afdfce9795bd7a4e7d219dcd9ced0c09cb0e

SHA512
f9240f2570f6c59834d1094f8a226de0023fcef0b94112c1ba670b00c0f5cd121a9d75395ca078745a57ab4c27f70d5881a68f6775fa8699042350543b0066c9

Download Submit
C:\Users\Admin\vooliv.exe

Filesize
204KB

MD5
1443e1341485ba5fd7ff59e40a07fbca

SHA1
0b47da18e16a95f0ec75100feb2e27bb1f71e45d

SHA256
cd32ed5ea1592a20ce8116ca3ee5afdfce9795bd7a4e7d219dcd9ced0c09cb0e

SHA512
f9240f2570f6c59834d1094f8a226de0023fcef0b94112c1ba670b00c0f5cd121a9d75395ca078745a57ab4c27f70d5881a68f6775fa8699042350543b0066c9

Download Submit
C:\Users\Admin\vooliv.exe

Filesize
204KB

MD5
1443e1341485ba5fd7ff59e40a07fbca

SHA1
0b47da18e16a95f0ec75100feb2e27bb1f71e45d

SHA256
cd32ed5ea1592a20ce8116ca3ee5afdfce9795bd7a4e7d219dcd9ced0c09cb0e

SHA512
f9240f2570f6c59834d1094f8a226de0023fcef0b94112c1ba670b00c0f5cd121a9d75395ca078745a57ab4c27f70d5881a68f6775fa8699042350543b0066c9

Download Submit
\Users\Admin\vooliv.exe

Filesize
204KB

MD5
1443e1341485ba5fd7ff59e40a07fbca

SHA1
0b47da18e16a95f0ec75100feb2e27bb1f71e45d

SHA256
cd32ed5ea1592a20ce8116ca3ee5afdfce9795bd7a4e7d219dcd9ced0c09cb0e

SHA512
f9240f2570f6c59834d1094f8a226de0023fcef0b94112c1ba670b00c0f5cd121a9d75395ca078745a57ab4c27f70d5881a68f6775fa8699042350543b0066c9

Download Submit
\Users\Admin\vooliv.exe

Filesize
204KB

MD5
1443e1341485ba5fd7ff59e40a07fbca

SHA1
0b47da18e16a95f0ec75100feb2e27bb1f71e45d

SHA256
cd32ed5ea1592a20ce8116ca3ee5afdfce9795bd7a4e7d219dcd9ced0c09cb0e

SHA512
f9240f2570f6c59834d1094f8a226de0023fcef0b94112c1ba670b00c0f5cd121a9d75395ca078745a57ab4c27f70d5881a68f6775fa8699042350543b0066c9

Download Submit