de3f3f1f6d692289bae0f1d3ed5d9cf12948dc9fe29291ebf9a7026825772445

Analysis

max time kernel
166s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
Size

211KB
MD5

5fb4e794e2786fbd9d9989ed4c47cfb0
SHA1

b03f9b31ff9e3941dc883937ec1bc866e0b7151b
SHA256

de3f3f1f6d692289bae0f1d3ed5d9cf12948dc9fe29291ebf9a7026825772445
SHA512

3e2f2bfc8273f9280fbf1c8abe7648f807ec7b79a3e9ddaf32f2788840c40940586acc7df2cf4ad66773d681a54a61266e8ceafe6a8256b7d570a656bb5fe69a
SSDEEP

3072:WD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOF:Wh8cBzHLRMpZ4d1ZF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe

Executes dropped EXE 4 IoCs

pid	Process
1100	userinit.exe
2920	spoolsw.exe
2792	swchost.exe
2688	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe
File opened for modification	\??\c:\windows\userinit.exe	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
1100	userinit.exe
1100	userinit.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
1100	userinit.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe
2792	swchost.exe
1100	userinit.exe
2792	swchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1100	userinit.exe
2792	swchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
1100	userinit.exe
1100	userinit.exe
2920	spoolsw.exe
2920	spoolsw.exe
2792	swchost.exe
2792	swchost.exe
2688	spoolsw.exe
2688	spoolsw.exe
1100	userinit.exe
1100	userinit.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1100	2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe	30
PID 2260 wrote to memory of 1100	2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe	30
PID 2260 wrote to memory of 1100	2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe	30
PID 2260 wrote to memory of 1100	2260	NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe	30
PID 1100 wrote to memory of 2920	1100	userinit.exe	31
PID 1100 wrote to memory of 2920	1100	userinit.exe	31
PID 1100 wrote to memory of 2920	1100	userinit.exe	31
PID 1100 wrote to memory of 2920	1100	userinit.exe	31
PID 2920 wrote to memory of 2792	2920	spoolsw.exe	32
PID 2920 wrote to memory of 2792	2920	spoolsw.exe	32
PID 2920 wrote to memory of 2792	2920	spoolsw.exe	32
PID 2920 wrote to memory of 2792	2920	spoolsw.exe	32
PID 2792 wrote to memory of 2688	2792	swchost.exe	33
PID 2792 wrote to memory of 2688	2792	swchost.exe	33
PID 2792 wrote to memory of 2688	2792	swchost.exe	33
PID 2792 wrote to memory of 2688	2792	swchost.exe	33

C:\Users\Admin\AppData\Local\Temp\NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5fb4e794e2786fbd9d9989ed4c47cfb0.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2792
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
fdf2e9b7fdcce6581942922b570d8bcf

SHA1
8f89236dcafbd69029fa68cf1f1d2145ae12a05b

SHA256
3702d20f428baba9b5b58899ecf17b896c935bc2cc00a1c56cc0b13447e6eb0b

SHA512
28347e9b41f81c6d3dbeb6beeb24feec18bb20527d13024e3add590a98676887f50e9a17fae886621edb03e97aa3ca3d35ebf7407d5425ddc1b64274b267f4d6

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
15abe98ba6c0ca307f946f1417cea5bc

SHA1
bac2983cd8bc65bbd54d710b20f96c2ff8fdbcd6

SHA256
041df3fd96d9fa86d500102dc6c7b4a9ff52093f6c34336e5507e1744351f2ed

SHA512
0b195338338e5ccbe55e68b2e9b9dfc920681fe87b494607ac8a70b50c603b0da29076c56471f84d81dcae76afe934b451cc16d6c94dd37cb1dde519da889e63

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
15abe98ba6c0ca307f946f1417cea5bc

SHA1
bac2983cd8bc65bbd54d710b20f96c2ff8fdbcd6

SHA256
041df3fd96d9fa86d500102dc6c7b4a9ff52093f6c34336e5507e1744351f2ed

SHA512
0b195338338e5ccbe55e68b2e9b9dfc920681fe87b494607ac8a70b50c603b0da29076c56471f84d81dcae76afe934b451cc16d6c94dd37cb1dde519da889e63

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
608c89a5cfc8a38b435e0a8fcd0b72ea

SHA1
b262317b0c264863c88b32efef876265f8c82130

SHA256
07f3e3e4b59446f46ca309f2389b537efff74c09f2ebb0b8cddc84081d8675b7

SHA512
2ff4789350cf658f0d81ec0a452fdef66c72f5aa80c1e97bb500e02959970697ee6feef9a45237cd866860fe4211cfcd2d41cf2b78413aa25417e540e2b783d0

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
3cc0b1fdd06649ebe9dd44c72e72b5b7

SHA1
b9f8a10d96593d4017950d32e623d06b19afdca0

SHA256
027f61b80809c93faf46e78779ecdb9def6a131364d20f1246b60b514e1e3d8e

SHA512
5caba758de9b076c5f4991e3319ea4e5716437863e16bb0d3790e8d28773f1aba3242b9a14b90ed30075efc1e1998f21791f9a1cfe11c2d7683343ea8e2e38f4

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
3cc0b1fdd06649ebe9dd44c72e72b5b7

SHA1
b9f8a10d96593d4017950d32e623d06b19afdca0

SHA256
027f61b80809c93faf46e78779ecdb9def6a131364d20f1246b60b514e1e3d8e

SHA512
5caba758de9b076c5f4991e3319ea4e5716437863e16bb0d3790e8d28773f1aba3242b9a14b90ed30075efc1e1998f21791f9a1cfe11c2d7683343ea8e2e38f4

Download Submit
\??\c:\windows\spoolsw.exe

Filesize
211KB

MD5
15abe98ba6c0ca307f946f1417cea5bc

SHA1
bac2983cd8bc65bbd54d710b20f96c2ff8fdbcd6

SHA256
041df3fd96d9fa86d500102dc6c7b4a9ff52093f6c34336e5507e1744351f2ed

SHA512
0b195338338e5ccbe55e68b2e9b9dfc920681fe87b494607ac8a70b50c603b0da29076c56471f84d81dcae76afe934b451cc16d6c94dd37cb1dde519da889e63

Download Submit
\??\c:\windows\swchost.exe

Filesize
211KB

MD5
608c89a5cfc8a38b435e0a8fcd0b72ea

SHA1
b262317b0c264863c88b32efef876265f8c82130

SHA256
07f3e3e4b59446f46ca309f2389b537efff74c09f2ebb0b8cddc84081d8675b7

SHA512
2ff4789350cf658f0d81ec0a452fdef66c72f5aa80c1e97bb500e02959970697ee6feef9a45237cd866860fe4211cfcd2d41cf2b78413aa25417e540e2b783d0

Download Submit
\??\c:\windows\userinit.exe

Filesize
211KB

MD5
3cc0b1fdd06649ebe9dd44c72e72b5b7

SHA1
b9f8a10d96593d4017950d32e623d06b19afdca0

SHA256
027f61b80809c93faf46e78779ecdb9def6a131364d20f1246b60b514e1e3d8e

SHA512
5caba758de9b076c5f4991e3319ea4e5716437863e16bb0d3790e8d28773f1aba3242b9a14b90ed30075efc1e1998f21791f9a1cfe11c2d7683343ea8e2e38f4

Download Submit
memory/1100-25-0x0000000002CE0000-0x0000000002D10000-memory.dmp

Filesize
192KB

Download
memory/1100-24-0x0000000002CE0000-0x0000000002D10000-memory.dmp

Filesize
192KB

Download
memory/1100-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-52-0x0000000002CE0000-0x0000000002D10000-memory.dmp

Filesize
192KB

Download
memory/2260-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2260-49-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2260-11-0x00000000034A0000-0x00000000034D0000-memory.dmp

Filesize
192KB

Download
memory/2688-47-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2792-53-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2920-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download