493e78a3d5a891fe43bc70583c7a9f5bf930df41baace0c529ab150eeaed6172

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
Size

135KB
MD5

26537760babe2bac3ed0bde0e82db190
SHA1

6e18d00221d97433a14fcb1b7810b3e80342015a
SHA256

493e78a3d5a891fe43bc70583c7a9f5bf930df41baace0c529ab150eeaed6172
SHA512

17567c03f70cb936c254cf47d23edc2098def82cf3f8b4a810805824813664fdcc36b42bfa88125e4ec86c2436b00dd02b4da8e697587f33a302773365d3fb9b
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBzqu:UVqoCl/YgjxEufVU0TbTyDDalXzqu

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4020	explorer.exe
3236	spoolsv.exe
3164	svchost.exe
1460	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe
4020	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4020	explorer.exe
3164	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
4020	explorer.exe
4020	explorer.exe
3236	spoolsv.exe
3236	spoolsv.exe
3164	svchost.exe
3164	svchost.exe
1460	spoolsv.exe
1460	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4020	3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	87
PID 3760 wrote to memory of 4020	3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	87
PID 3760 wrote to memory of 4020	3760	NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe	87
PID 4020 wrote to memory of 3236	4020	explorer.exe	89
PID 4020 wrote to memory of 3236	4020	explorer.exe	89
PID 4020 wrote to memory of 3236	4020	explorer.exe	89
PID 3236 wrote to memory of 3164	3236	spoolsv.exe	90
PID 3236 wrote to memory of 3164	3236	spoolsv.exe	90
PID 3236 wrote to memory of 3164	3236	spoolsv.exe	90
PID 3164 wrote to memory of 1460	3164	svchost.exe	91
PID 3164 wrote to memory of 1460	3164	svchost.exe	91
PID 3164 wrote to memory of 1460	3164	svchost.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.26537760babe2bac3ed0bde0e82db190_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4020
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3164
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
84ccdf3e765e0a436d1df9c5bdc95297

SHA1
978fee3c8b3152a623165d56948164dcb3c0bf2e

SHA256
fafc0293a418794be72bec6ff80b3b4e96ecf5d9cf0547ad00170082955a34ca

SHA512
df7083801601103cd3edd9e9cb0f84ad9d542ab2be6ffd6bdccb1e158de8bf3634bf99f95185a2591218484dbdfaa5f14deafca178ccbd5157c3b6376854f547

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2bb17e0e0d887f875f12875c2312b0a2

SHA1
7a6dd9b7a4e8943e8264c79348f11f1cc133fa12

SHA256
198a98dabc0564b72e5ecdf2596cd024aa8df38f642829c03eb07c988886b901

SHA512
c6e4af7724933708e356c0abf88037db9577da59b6e8606d24a6d0d7e1c46bf3b9e79f082ccc7e82f1224e797221f640d3072c39305a9b4ca5f40afa09cc72f0

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2bb17e0e0d887f875f12875c2312b0a2

SHA1
7a6dd9b7a4e8943e8264c79348f11f1cc133fa12

SHA256
198a98dabc0564b72e5ecdf2596cd024aa8df38f642829c03eb07c988886b901

SHA512
c6e4af7724933708e356c0abf88037db9577da59b6e8606d24a6d0d7e1c46bf3b9e79f082ccc7e82f1224e797221f640d3072c39305a9b4ca5f40afa09cc72f0

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2bb17e0e0d887f875f12875c2312b0a2

SHA1
7a6dd9b7a4e8943e8264c79348f11f1cc133fa12

SHA256
198a98dabc0564b72e5ecdf2596cd024aa8df38f642829c03eb07c988886b901

SHA512
c6e4af7724933708e356c0abf88037db9577da59b6e8606d24a6d0d7e1c46bf3b9e79f082ccc7e82f1224e797221f640d3072c39305a9b4ca5f40afa09cc72f0

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
43e149d1bcf7a514b7a155b40b072f22

SHA1
b4bc59ac5f7e1a3ca16dfef40099e50730a6dd5b

SHA256
e0a2c4f48beec6d64d37c2bbb1bb87e0636dc09ed3c23814f8fbd5e54d741c33

SHA512
60404d0835d5ff78b0dfad6c2e6d2f290007952b7615297cf9422179c3ff3eb17132c147e14306e4b93d229c932c261e135663a373142395ba770c5deb36d064

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
2bb17e0e0d887f875f12875c2312b0a2

SHA1
7a6dd9b7a4e8943e8264c79348f11f1cc133fa12

SHA256
198a98dabc0564b72e5ecdf2596cd024aa8df38f642829c03eb07c988886b901

SHA512
c6e4af7724933708e356c0abf88037db9577da59b6e8606d24a6d0d7e1c46bf3b9e79f082ccc7e82f1224e797221f640d3072c39305a9b4ca5f40afa09cc72f0

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
43e149d1bcf7a514b7a155b40b072f22

SHA1
b4bc59ac5f7e1a3ca16dfef40099e50730a6dd5b

SHA256
e0a2c4f48beec6d64d37c2bbb1bb87e0636dc09ed3c23814f8fbd5e54d741c33

SHA512
60404d0835d5ff78b0dfad6c2e6d2f290007952b7615297cf9422179c3ff3eb17132c147e14306e4b93d229c932c261e135663a373142395ba770c5deb36d064

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
84ccdf3e765e0a436d1df9c5bdc95297

SHA1
978fee3c8b3152a623165d56948164dcb3c0bf2e

SHA256
fafc0293a418794be72bec6ff80b3b4e96ecf5d9cf0547ad00170082955a34ca

SHA512
df7083801601103cd3edd9e9cb0f84ad9d542ab2be6ffd6bdccb1e158de8bf3634bf99f95185a2591218484dbdfaa5f14deafca178ccbd5157c3b6376854f547

Download Submit
memory/1460-32-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3164-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3236-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3760-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3760-34-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4020-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download