37923d1ede42dc790dce25ad2fb4a7df7f0e14d2816ea47733ef76e0cb93d74d

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1e4b91d51977e6c992e58762d8e103b0.exe
Size

329KB
MD5

1e4b91d51977e6c992e58762d8e103b0
SHA1

7e3b69f03b6c059e2c36bf1ba3d58d6866f58565
SHA256

37923d1ede42dc790dce25ad2fb4a7df7f0e14d2816ea47733ef76e0cb93d74d
SHA512

1e7d57e0f922dffca7009bcfbd1d609c8b730be454ae77eb6a4a2783c2381ada6017ebd16868f15a6bcdeff34299996b83d1f8320198a8563a90da30bd59e483
SSDEEP

6144:iw+oeJbqy5d5SKVGzLSNnHFASbL98HuSoKBe6qZlhXcF0Vv4:cdbqy5z8zG1HFA1HuHdxM

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2548	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
3052	kspoold.exe
2776	kspoold.exe

Loads dropped DLL 2 IoCs

pid	Process
2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe
2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000012024-2.dat	upx
behavioral1/memory/2176-3-0x00000000025F0000-0x000000000267C000-memory.dmp	upx
behavioral1/files/0x0009000000012024-5.dat	upx
behavioral1/files/0x0009000000012024-7.dat	upx
behavioral1/files/0x0009000000012024-10.dat	upx
behavioral1/memory/3052-11-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/files/0x0009000000012024-13.dat	upx
behavioral1/memory/3052-16-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-22-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-23-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-28-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-33-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-41-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-46-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-49-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-52-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-55-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-61-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-64-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2776-69-0x0000000000400000-0x000000000048C000-memory.dmp	upx

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	kspoold.exe
File opened (read-only)	\??\G:	kspoold.exe
File opened (read-only)	\??\I:	kspoold.exe
File opened (read-only)	\??\H:	kspoold.exe
File opened (read-only)	\??\J:	kspoold.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kspoold.exe	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2140	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3052	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	28
PID 2176 wrote to memory of 3052	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	28
PID 2176 wrote to memory of 3052	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	28
PID 2176 wrote to memory of 3052	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	28
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2140	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	30
PID 2176 wrote to memory of 2548	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	32
PID 2176 wrote to memory of 2548	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	32
PID 2176 wrote to memory of 2548	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	32
PID 2176 wrote to memory of 2548	2176	NEAS.1e4b91d51977e6c992e58762d8e103b0.exe	32

C:\Users\Admin\AppData\Local\Temp\NEAS.1e4b91d51977e6c992e58762d8e103b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1e4b91d51977e6c992e58762d8e103b0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\kspoold.exe
  "C:\Windows\system32\kspoold.exe" /INSTALL /SILENT
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
  2⤵
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\NEAS.1e4b91d51977e6c992e58762d8e103b0.exe"
  2⤵
  - Deletes itself
  PID:2548

C:\Windows\SysWOW64\kspoold.exe
C:\Windows\SysWOW64\kspoold.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.1e4b91d51977e6c992e58762d8e103b0.xls

Filesize
69KB

MD5
9d92bfa7868b65df6f03575534624ab5

SHA1
1674ca78a021df914d5f8779db5bcdb17b6f66f9

SHA256
619fb94b4caf999b1e2050bfd89799cea7ed8a3e58aabc62ff9cc0eb459fe855

SHA512
6516088325a4416c7132afad2fc4a067e5e4c381c682bc1d34ba0e97ac3ef067b1c27d8430cb02f1880a548fd6e847826e1dfb0bdc33ecb4743cef98d34da584

Download Submit
C:\Windows\SysWOW64\kspoold.exe

Filesize
215KB

MD5
e340e6c3430e9578ef39afe0a59d1cfd

SHA1
3d2e7fabe662facfe882be47b3458d32ab90aff9

SHA256
794750c727638bb7eb1c3bb3a449ccc3de377dde66883168fa909ad0f260744e

SHA512
0793aff3da9c70564b963abbbefa90f75106d7d348abc4aded346f26e797686f07c1bfd5e5ba46bcd9e42e91fff5f85ad79bbe33fa13601454ebb98e6410ef8d

Download Submit
C:\Windows\SysWOW64\kspoold.exe

Filesize
215KB

MD5
e340e6c3430e9578ef39afe0a59d1cfd

SHA1
3d2e7fabe662facfe882be47b3458d32ab90aff9

SHA256
794750c727638bb7eb1c3bb3a449ccc3de377dde66883168fa909ad0f260744e

SHA512
0793aff3da9c70564b963abbbefa90f75106d7d348abc4aded346f26e797686f07c1bfd5e5ba46bcd9e42e91fff5f85ad79bbe33fa13601454ebb98e6410ef8d

Download Submit
C:\Windows\SysWOW64\kspoold.exe

Filesize
215KB

MD5
e340e6c3430e9578ef39afe0a59d1cfd

SHA1
3d2e7fabe662facfe882be47b3458d32ab90aff9

SHA256
794750c727638bb7eb1c3bb3a449ccc3de377dde66883168fa909ad0f260744e

SHA512
0793aff3da9c70564b963abbbefa90f75106d7d348abc4aded346f26e797686f07c1bfd5e5ba46bcd9e42e91fff5f85ad79bbe33fa13601454ebb98e6410ef8d

Download Submit
C:\Windows\Temp\UninstallC.TMP

Filesize
1KB

MD5
16e0fd5af45ceb02ce13f310b84337c7

SHA1
8552ddee69def6eb532b56b3f7f03144c3315076

SHA256
ad71afb4630b7bf40364b0dc49defc01ea6f0da2f6c362e855af77dfb3e3befc

SHA512
f95af26a617e627e3b9f7a8bac4472dcf36c019854aca6b318895ae00f92029d9800268d0c575e0efcf213bcfbf78a17c1949d1a69b773511902c9d1d9e06c34

Download Submit
C:\Windows\Temp\UninstallC.TMP

Filesize
841B

MD5
f8ffd5768ee8ce0115596c1560637e1a

SHA1
62b293e5dbc28f12791d7b51699e8eeac9468d94

SHA256
6c5ffbc90ee86375412d657757f22b3f476dad34ca1c50d7c9b6dae4f8b1cf54

SHA512
0ec24b8e1a8351e560ff93a26cbca0cdcdb5d840a2c59d2b42e0411270d3374897a535e9fcd7ca49dcd44947c105aabf8841a3d65a09108f6e41c2f76c998e3d

Download Submit
C:\Windows\Temp\UninstallC.TMP

Filesize
713B

MD5
5d4164abc08b2823f06a6113d9dbe75d

SHA1
f7b73f3c99bdace738efd1de6a881b6ec8cbfe9d

SHA256
214b3f55f7838b1af4696aaca72c24067b8db529eea4f2ae5e21db60ae74963d

SHA512
2d9cfaaf8c4eb92cfa896fe1bd4e40e2ae675b77b5c8461766b958f699f519f9ec95678980ecc8b4ed49e8608bc59631b6b0118861c35ac05a5ccebd2f37b31d

Download Submit
\Windows\SysWOW64\kspoold.exe

Filesize
215KB

MD5
e340e6c3430e9578ef39afe0a59d1cfd

SHA1
3d2e7fabe662facfe882be47b3458d32ab90aff9

SHA256
794750c727638bb7eb1c3bb3a449ccc3de377dde66883168fa909ad0f260744e

SHA512
0793aff3da9c70564b963abbbefa90f75106d7d348abc4aded346f26e797686f07c1bfd5e5ba46bcd9e42e91fff5f85ad79bbe33fa13601454ebb98e6410ef8d

Download Submit
\Windows\SysWOW64\kspoold.exe

Filesize
215KB

MD5
e340e6c3430e9578ef39afe0a59d1cfd

SHA1
3d2e7fabe662facfe882be47b3458d32ab90aff9

SHA256
794750c727638bb7eb1c3bb3a449ccc3de377dde66883168fa909ad0f260744e

SHA512
0793aff3da9c70564b963abbbefa90f75106d7d348abc4aded346f26e797686f07c1bfd5e5ba46bcd9e42e91fff5f85ad79bbe33fa13601454ebb98e6410ef8d

Download Submit
memory/2140-19-0x0000000071E6D000-0x0000000071E78000-memory.dmp

Filesize
44KB

Download
memory/2140-24-0x0000000071E6D000-0x0000000071E78000-memory.dmp

Filesize
44KB

Download
memory/2140-17-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2176-29-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2176-18-0x00000000025F0000-0x000000000267C000-memory.dmp

Filesize
560KB

Download
memory/2176-3-0x00000000025F0000-0x000000000267C000-memory.dmp

Filesize
560KB

Download
memory/2176-21-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2776-22-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-49-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-69-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-28-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-15-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2776-33-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-41-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-46-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-23-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-52-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-55-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2776-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-12-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/3052-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads