45c4a1e2639094f409f86a0320d4ecba31e4960d90ee0ad3b84d1969c6ff13bc

Analysis

max time kernel
117s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4a1086e1df895707f659d6795c7ac520.exe
Size

333KB
MD5

4a1086e1df895707f659d6795c7ac520
SHA1

8074b96a26e214307bb0e4b6e74828ccf466ef13
SHA256

45c4a1e2639094f409f86a0320d4ecba31e4960d90ee0ad3b84d1969c6ff13bc
SHA512

8e2cb49ef215e2523cba8a00b5c1f24176a1a005c6f0b55ac9b87d330be923130565eaf37c35332e898e56054d6277c3e372678c808aa79f557cde6467d58c0b
SSDEEP

1536:SAqVEcpwlT7hgaZWgWhGv7B1hXW4iLW8fk6M50dGW7:e8RhgAWIY3Lab00W7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2012	svchost.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\G:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\K:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\J:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\V:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\L:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\O:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\R:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\S:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\E:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\M:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\H:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\P:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\Q:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\I:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\T:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\U:	NEAS.4a1086e1df895707f659d6795c7ac520.exe
File opened (read-only)	\??\N:	NEAS.4a1086e1df895707f659d6795c7ac520.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV	NEAS.4a1086e1df895707f659d6795c7ac520.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV\EFile = "050035084052034073215053051034065172001071145163146221077186024217093060253205114112223140146245065075116208197134154040"	NEAS.4a1086e1df895707f659d6795c7ac520.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV\DFile	NEAS.4a1086e1df895707f659d6795c7ac520.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3848	NEAS.4a1086e1df895707f659d6795c7ac520.exe
3848	NEAS.4a1086e1df895707f659d6795c7ac520.exe
2012	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2012	3848	NEAS.4a1086e1df895707f659d6795c7ac520.exe	89
PID 3848 wrote to memory of 2012	3848	NEAS.4a1086e1df895707f659d6795c7ac520.exe	89
PID 3848 wrote to memory of 2012	3848	NEAS.4a1086e1df895707f659d6795c7ac520.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.4a1086e1df895707f659d6795c7ac520.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4a1086e1df895707f659d6795c7ac520.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848
- F:\$RECYCLE.BIN\svchost.exe
  F:\$RECYCLE.BIN\svchost.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\$RECYCLE.BIN\svchost.exe

Filesize
334KB

MD5
d891c60eca9664fc5ae90a17ade1dbd2

SHA1
bed3496dac44d9983b28dc03526285f5a112eed9

SHA256
525d461725b611d1e42bd8872265568f6c15cff3544f0bd7603877cf7ba18372

SHA512
39ecf280ce32e36553767c5ad951b7c09364514b79ac0ac15849093c45c844448039da5316c5edff04dbd8129e24307d56a919f0a1e25271c6eb28f5b782d215

Download Submit
F:\$RECYCLE.BIN\svchost.exe

Filesize
334KB

MD5
d891c60eca9664fc5ae90a17ade1dbd2

SHA1
bed3496dac44d9983b28dc03526285f5a112eed9

SHA256
525d461725b611d1e42bd8872265568f6c15cff3544f0bd7603877cf7ba18372

SHA512
39ecf280ce32e36553767c5ad951b7c09364514b79ac0ac15849093c45c844448039da5316c5edff04dbd8129e24307d56a919f0a1e25271c6eb28f5b782d215

Download Submit
memory/2012-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3848-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download