f2a3a9f378db287bdd6aeb8c68e8e6dbb4c544d01a7e48ce58f4c9f29b5e4b7b

General

Target

NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Size

458KB
MD5

279fca2fb9903b7be96c3cadc7ef3a50
SHA1

e169f06c121656afcd28fbe0f90cd4565fc31c27
SHA256

f2a3a9f378db287bdd6aeb8c68e8e6dbb4c544d01a7e48ce58f4c9f29b5e4b7b
SHA512

c500b449dee51f63d1fe621987e4bd69e0e6718f07ede27ec13f1d562719819b4f5d58ed6be6c8ee2e2a4e2d0a86b9e0464c9d3c592933d3e83f61eb892654df
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iioct0IwdNOuLcktJFksISWmSILKxrj:/pW2IoioS6jsk

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe BATCF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe NTPAD %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe BATCF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe CMDSF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\giffile\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe JPGIF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe NTPAD %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe NTPAD %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe VBSSF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe HTMWF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtffile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe RTFDF %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe NTPAD %1"	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4776	reg.exe
5040	reg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4776	4264	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe	93
PID 4264 wrote to memory of 4776	4264	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe	93
PID 4264 wrote to memory of 5040	4264	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe	94
PID 4264 wrote to memory of 5040	4264	NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe	94

C:\Users\Admin\AppData\Local\Temp\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.279fca2fb9903b7be96c3cadc7ef3a50.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:4776
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.bak

Filesize
458KB

MD5
38112246f923effc0248089d1526aeca

SHA1
362d3ce055c040355b51e42a0da0e54b3aac9a69

SHA256
21025a54f6b2afd3abc7cd18b819ed48823fc33ef7c20f22b568e8d0af7811ac

SHA512
b71c7208d8bf5f27264698caa79aaff1434fdd6d3bf534557ce91dee12fc7e5d150aa9c759b56bdb9420ef3f044e5fd3a10e7845868b14aeaa051d2713f16629

Download Submit
memory/4264-0-0x0000021C9A0A0000-0x0000021C9A0C8000-memory.dmp

Filesize
160KB

Download
memory/4264-1-0x00007FFE80610000-0x00007FFE810D1000-memory.dmp

Filesize
10.8MB

Download
memory/4264-2-0x00007FFE80610000-0x00007FFE810D1000-memory.dmp

Filesize
10.8MB

Download
memory/4264-3-0x0000021CB46A0000-0x0000021CB46B0000-memory.dmp

Filesize
64KB

Download
memory/4264-4-0x0000021CB46A0000-0x0000021CB46B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads