dd83928aaeeaa6d80f7328e06bdec7812f86b20abd89dc6bdeb9e0c980aee722

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.000e39d660f2731742fe0650ec6ff3f0.exe
Size

84KB
MD5

000e39d660f2731742fe0650ec6ff3f0
SHA1

2758329a2de98a9de807551acf06e967ad1f7670
SHA256

dd83928aaeeaa6d80f7328e06bdec7812f86b20abd89dc6bdeb9e0c980aee722
SHA512

33167a66c60356b55aec77b850b6c754e61a0377ed8755a2a9df7be3700686a437dab2bef52c8f6f118c893fd2f28ca604775e8e7cc214e175ae27dfad3e9995
SSDEEP

768:43ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:43cJu5hBVWq2kN6LXwPVGT9lgA5gs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\SOFTWARE\Microsoft\Internet Explorer\Main	NEAS.000e39d660f2731742fe0650ec6ff3f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	NEAS.000e39d660f2731742fe0650ec6ff3f0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	NEAS.000e39d660f2731742fe0650ec6ff3f0.exe
2552	NEAS.000e39d660f2731742fe0650ec6ff3f0.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1184	2552	NEAS.000e39d660f2731742fe0650ec6ff3f0.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\NEAS.000e39d660f2731742fe0650ec6ff3f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.000e39d660f2731742fe0650ec6ff3f0.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-0-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download