d62b64fadd7c93ce8086c47cea0e9fd962b38edacc67f56088c1619d6fa7baf1

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
Size

135KB
MD5

cc7cceca9cae79930ab8e39bb662e5f0
SHA1

0c966230f71d138e13d608ec6c772c03aef34c64
SHA256

d62b64fadd7c93ce8086c47cea0e9fd962b38edacc67f56088c1619d6fa7baf1
SHA512

a979cdd3e31e451137d281f3e92af433f7846330c55e400e25e29d588726b2c43a584ba8a8deb4006f4fae68bbabfa0d22a98b63a2b0c6ffb46ba823797114a3
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVQx:UVqoCl/YgjxEufVU0TbTyDDal6x

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1892	explorer.exe
4832	spoolsv.exe
2140	svchost.exe
2336	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1892	explorer.exe
2140	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
1892	explorer.exe
1892	explorer.exe
4832	spoolsv.exe
4832	spoolsv.exe
2140	svchost.exe
2140	svchost.exe
2336	spoolsv.exe
2336	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 1892	700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe	84
PID 700 wrote to memory of 1892	700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe	84
PID 700 wrote to memory of 1892	700	NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe	84
PID 1892 wrote to memory of 4832	1892	explorer.exe	86
PID 1892 wrote to memory of 4832	1892	explorer.exe	86
PID 1892 wrote to memory of 4832	1892	explorer.exe	86
PID 4832 wrote to memory of 2140	4832	spoolsv.exe	88
PID 4832 wrote to memory of 2140	4832	spoolsv.exe	88
PID 4832 wrote to memory of 2140	4832	spoolsv.exe	88
PID 2140 wrote to memory of 2336	2140	svchost.exe	89
PID 2140 wrote to memory of 2336	2140	svchost.exe	89
PID 2140 wrote to memory of 2336	2140	svchost.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cc7cceca9cae79930ab8e39bb662e5f0.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1892
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2140
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
b4fd1891f0f56bc08b7cbb04ebd68918

SHA1
d7084b9835e2c815a7e13ddee1e4eb93a24f6f36

SHA256
b4be8a7efbc48c6936ffd0c5b7c3ba2cefbf7af3a3ca9e8f960c5f094b850112

SHA512
2cacf934bd4120af92e5ae21b95a4fd89346826069c61961a97fcdbb48a4ff931000e2c279dcc3ba1937424f563b0f94eeaecef14b8425a90b0867ad9470a209

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
de5d33b823e68a1c919289b3112a31f1

SHA1
ad3b61ae68403647b3c9ea8d1c940c6899886857

SHA256
b3867b49038ba288ccf6fe500b1bd6cbcdb5c0b0da4c5f75c7139a2c7bcf873e

SHA512
50fe9818138c244ec74f47c8867879ba1aedd53bc88440814b42e09fd172ccd08a6ca6b276f22bb92ff2d2e106240801a557dbcf7f53261340e1f278c9a8572e

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
de5d33b823e68a1c919289b3112a31f1

SHA1
ad3b61ae68403647b3c9ea8d1c940c6899886857

SHA256
b3867b49038ba288ccf6fe500b1bd6cbcdb5c0b0da4c5f75c7139a2c7bcf873e

SHA512
50fe9818138c244ec74f47c8867879ba1aedd53bc88440814b42e09fd172ccd08a6ca6b276f22bb92ff2d2e106240801a557dbcf7f53261340e1f278c9a8572e

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
de5d33b823e68a1c919289b3112a31f1

SHA1
ad3b61ae68403647b3c9ea8d1c940c6899886857

SHA256
b3867b49038ba288ccf6fe500b1bd6cbcdb5c0b0da4c5f75c7139a2c7bcf873e

SHA512
50fe9818138c244ec74f47c8867879ba1aedd53bc88440814b42e09fd172ccd08a6ca6b276f22bb92ff2d2e106240801a557dbcf7f53261340e1f278c9a8572e

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
b8c9327673f454cc3623d1cfe7834680

SHA1
d22f37573dec8ffcae0d6a5f4818ba394fd6e9e8

SHA256
6426a97204349e6f98b11e568106c820b0fbaf82cf17a333766f506e84cb7354

SHA512
9c625aef6bef2c4173bf00e4213a9fd75995c8ee5549c59f03626fb1c759514a64e5bdb5df11a0e1c175dc8b9b38fc29911caced9ffcae544f6be208a1b5ca55

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
de5d33b823e68a1c919289b3112a31f1

SHA1
ad3b61ae68403647b3c9ea8d1c940c6899886857

SHA256
b3867b49038ba288ccf6fe500b1bd6cbcdb5c0b0da4c5f75c7139a2c7bcf873e

SHA512
50fe9818138c244ec74f47c8867879ba1aedd53bc88440814b42e09fd172ccd08a6ca6b276f22bb92ff2d2e106240801a557dbcf7f53261340e1f278c9a8572e

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
b8c9327673f454cc3623d1cfe7834680

SHA1
d22f37573dec8ffcae0d6a5f4818ba394fd6e9e8

SHA256
6426a97204349e6f98b11e568106c820b0fbaf82cf17a333766f506e84cb7354

SHA512
9c625aef6bef2c4173bf00e4213a9fd75995c8ee5549c59f03626fb1c759514a64e5bdb5df11a0e1c175dc8b9b38fc29911caced9ffcae544f6be208a1b5ca55

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
b4fd1891f0f56bc08b7cbb04ebd68918

SHA1
d7084b9835e2c815a7e13ddee1e4eb93a24f6f36

SHA256
b4be8a7efbc48c6936ffd0c5b7c3ba2cefbf7af3a3ca9e8f960c5f094b850112

SHA512
2cacf934bd4120af92e5ae21b95a4fd89346826069c61961a97fcdbb48a4ff931000e2c279dcc3ba1937424f563b0f94eeaecef14b8425a90b0867ad9470a209

Download Submit
memory/700-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/700-34-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1892-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2140-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2336-32-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4832-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download