493e78a3d5a891fe43bc70583c7a9f5bf930df41baace0c529ab150eeaed6172

Analysis

max time kernel
151s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
Size

135KB
MD5

26537760babe2bac3ed0bde0e82db190
SHA1

6e18d00221d97433a14fcb1b7810b3e80342015a
SHA256

493e78a3d5a891fe43bc70583c7a9f5bf930df41baace0c529ab150eeaed6172
SHA512

17567c03f70cb936c254cf47d23edc2098def82cf3f8b4a810805824813664fdcc36b42bfa88125e4ec86c2436b00dd02b4da8e697587f33a302773365d3fb9b
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBzqu:UVqoCl/YgjxEufVU0TbTyDDalXzqu

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2008	explorer.exe
2260	spoolsv.exe
704	svchost.exe
1640	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2008	explorer.exe
2260	spoolsv.exe
704	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1608	schtasks.exe
2752	schtasks.exe
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
704	svchost.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
704	svchost.exe
704	svchost.exe
2008	explorer.exe
704	svchost.exe
2008	explorer.exe
704	svchost.exe
2008	explorer.exe
704	svchost.exe
2008	explorer.exe
704	svchost.exe
2008	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2008	explorer.exe
704	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
2008	explorer.exe
2008	explorer.exe
2260	spoolsv.exe
2260	spoolsv.exe
704	svchost.exe
704	svchost.exe
1640	spoolsv.exe
1640	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2008	2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	28
PID 2544 wrote to memory of 2008	2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	28
PID 2544 wrote to memory of 2008	2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	28
PID 2544 wrote to memory of 2008	2544	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	28
PID 2008 wrote to memory of 2260	2008	explorer.exe	29
PID 2008 wrote to memory of 2260	2008	explorer.exe	29
PID 2008 wrote to memory of 2260	2008	explorer.exe	29
PID 2008 wrote to memory of 2260	2008	explorer.exe	29
PID 2260 wrote to memory of 704	2260	spoolsv.exe	30
PID 2260 wrote to memory of 704	2260	spoolsv.exe	30
PID 2260 wrote to memory of 704	2260	spoolsv.exe	30
PID 2260 wrote to memory of 704	2260	spoolsv.exe	30
PID 704 wrote to memory of 1640	704	svchost.exe	31
PID 704 wrote to memory of 1640	704	svchost.exe	31
PID 704 wrote to memory of 1640	704	svchost.exe	31
PID 704 wrote to memory of 1640	704	svchost.exe	31
PID 2008 wrote to memory of 1856	2008	explorer.exe	32
PID 2008 wrote to memory of 1856	2008	explorer.exe	32
PID 2008 wrote to memory of 1856	2008	explorer.exe	32
PID 2008 wrote to memory of 1856	2008	explorer.exe	32
PID 704 wrote to memory of 1608	704	svchost.exe	33
PID 704 wrote to memory of 1608	704	svchost.exe	33
PID 704 wrote to memory of 1608	704	svchost.exe	33
PID 704 wrote to memory of 1608	704	svchost.exe	33
PID 704 wrote to memory of 2752	704	svchost.exe	38
PID 704 wrote to memory of 2752	704	svchost.exe	38
PID 704 wrote to memory of 2752	704	svchost.exe	38
PID 704 wrote to memory of 2752	704	svchost.exe	38
PID 704 wrote to memory of 2660	704	svchost.exe	40
PID 704 wrote to memory of 2660	704	svchost.exe	40
PID 704 wrote to memory of 2660	704	svchost.exe	40
PID 704 wrote to memory of 2660	704	svchost.exe	40

C:\Users\Admin\AppData\Local\Temp\NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:704
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:40 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1608
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:41 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2752
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:42 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2660
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
d4d864abde223501464b2f24ac74da1c

SHA1
ca347ec43d73c04ad634d03b14063e2c637671f0

SHA256
133521aa4587092ef8c82899a12d1f87465881a77ec2b33177c553c80aa6e3ae

SHA512
58f062ee519a00d17c0c379bbbe29a6dffce1b3caebd34a9d6c3c6d7904ad5f442210d8f1911f7a766df107e2c7f8e6a67a3e5c705e80e0bbcde665fd0fd8d22

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
00d15d0bac38c803d8f5ed0da74ce71f

SHA1
8edfa388c9914ff88ccde2f321e8fbecd4dbd8cd

SHA256
5a45f8f5eb3483a9b8600aea93b3e5db71222f2dc941e6178c8abcbdd96ae466

SHA512
1938d668424c4564d3b81cfc96004c92c9f94e708235940513a244e959f96edb40e94123dfd9bd3fa9ef03e8805b9ef509640ca9e995efe1f77654161d44f065

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
00d15d0bac38c803d8f5ed0da74ce71f

SHA1
8edfa388c9914ff88ccde2f321e8fbecd4dbd8cd

SHA256
5a45f8f5eb3483a9b8600aea93b3e5db71222f2dc941e6178c8abcbdd96ae466

SHA512
1938d668424c4564d3b81cfc96004c92c9f94e708235940513a244e959f96edb40e94123dfd9bd3fa9ef03e8805b9ef509640ca9e995efe1f77654161d44f065

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
d4d864abde223501464b2f24ac74da1c

SHA1
ca347ec43d73c04ad634d03b14063e2c637671f0

SHA256
133521aa4587092ef8c82899a12d1f87465881a77ec2b33177c553c80aa6e3ae

SHA512
58f062ee519a00d17c0c379bbbe29a6dffce1b3caebd34a9d6c3c6d7904ad5f442210d8f1911f7a766df107e2c7f8e6a67a3e5c705e80e0bbcde665fd0fd8d22

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
d4d864abde223501464b2f24ac74da1c

SHA1
ca347ec43d73c04ad634d03b14063e2c637671f0

SHA256
133521aa4587092ef8c82899a12d1f87465881a77ec2b33177c553c80aa6e3ae

SHA512
58f062ee519a00d17c0c379bbbe29a6dffce1b3caebd34a9d6c3c6d7904ad5f442210d8f1911f7a766df107e2c7f8e6a67a3e5c705e80e0bbcde665fd0fd8d22

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2e924c4ed53cb954cd3ca7c4de8f58d2

SHA1
2fcc29fb22f851952f33c349b7d5c6f494846761

SHA256
4a5765fa8369d5e781ccc50b4645eb629be4a4496f57a2fe1c85ecff342158ba

SHA512
c46e4e4aef82430d9e62d9dee2cb33c0dc0ae4d49fc7c3b5f78453effc399931a4317f45bcbb6e679c4b0143121cdafd65b21382cb00d9fe774c60309b343015

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
00d15d0bac38c803d8f5ed0da74ce71f

SHA1
8edfa388c9914ff88ccde2f321e8fbecd4dbd8cd

SHA256
5a45f8f5eb3483a9b8600aea93b3e5db71222f2dc941e6178c8abcbdd96ae466

SHA512
1938d668424c4564d3b81cfc96004c92c9f94e708235940513a244e959f96edb40e94123dfd9bd3fa9ef03e8805b9ef509640ca9e995efe1f77654161d44f065

Download Submit
memory/704-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1640-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2008-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2260-28-0x00000000002E0000-0x00000000002FF000-memory.dmp

Filesize
124KB

Download
memory/2260-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download