2c19efe945a9b183be41c2db5b883cae7156fe01a37376305f47bc5af299fb79

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
Size

204KB
MD5

4a635c77d44a596ef0b5c0e38c05d9c0
SHA1

20515e905b52ea2021e3e43aa7fb4801e480e57e
SHA256

2c19efe945a9b183be41c2db5b883cae7156fe01a37376305f47bc5af299fb79
SHA512

8fc31cb56602adc80ef0a575fe20ee27756a6824a64aad155a05d071a2f24d30516138600e82a8175434aed8d99d2af0861d97edc9e1794ff75967b6e54f6f1e
SSDEEP

3072:QmRW8MDaO0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWr5:rAFmO4QxL7B9W0c1RCzR/fSmlY

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	saaqoq.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	saaqoq.exe

Loads dropped DLL 2 IoCs

pid	Process
1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /w"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /b"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /h"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /p"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /a"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /u"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /e"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /x"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /y"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /q"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /g"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /s"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /r"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /j"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /l"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /d"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /m"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /o"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /n"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /q"	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /k"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /t"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /z"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /i"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /v"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /f"	saaqoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\saaqoq = "C:\\Users\\Admin\\saaqoq.exe /c"	saaqoq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe
2944	saaqoq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
2944	saaqoq.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2944	1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe	28
PID 1348 wrote to memory of 2944	1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe	28
PID 1348 wrote to memory of 2944	1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe	28
PID 1348 wrote to memory of 2944	1348	NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\saaqoq.exe
  "C:\Users\Admin\saaqoq.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\saaqoq.exe

Filesize
204KB

MD5
975ebe095625e608ec1a442f2a369c66

SHA1
a085de883820ab0dc08b624e2bfc7fe4916a9c50

SHA256
5c2283e44ebc2876901d65cd49fc5fea0bfabe63b99979bc6a9ad4e549fe97a0

SHA512
a025ddce9cf526e28bbb175ab6881404944eecdb9a7fb5050f904086df20b38d59a7b6be6b1b73b9d1b4c4d60a9547fdb3806962d9cb4c44c238689d6cb81ba8

Download Submit
C:\Users\Admin\saaqoq.exe

Filesize
204KB

MD5
975ebe095625e608ec1a442f2a369c66

SHA1
a085de883820ab0dc08b624e2bfc7fe4916a9c50

SHA256
5c2283e44ebc2876901d65cd49fc5fea0bfabe63b99979bc6a9ad4e549fe97a0

SHA512
a025ddce9cf526e28bbb175ab6881404944eecdb9a7fb5050f904086df20b38d59a7b6be6b1b73b9d1b4c4d60a9547fdb3806962d9cb4c44c238689d6cb81ba8

Download Submit
C:\Users\Admin\saaqoq.exe

Filesize
204KB

MD5
975ebe095625e608ec1a442f2a369c66

SHA1
a085de883820ab0dc08b624e2bfc7fe4916a9c50

SHA256
5c2283e44ebc2876901d65cd49fc5fea0bfabe63b99979bc6a9ad4e549fe97a0

SHA512
a025ddce9cf526e28bbb175ab6881404944eecdb9a7fb5050f904086df20b38d59a7b6be6b1b73b9d1b4c4d60a9547fdb3806962d9cb4c44c238689d6cb81ba8

Download Submit
\Users\Admin\saaqoq.exe

Filesize
204KB

MD5
975ebe095625e608ec1a442f2a369c66

SHA1
a085de883820ab0dc08b624e2bfc7fe4916a9c50

SHA256
5c2283e44ebc2876901d65cd49fc5fea0bfabe63b99979bc6a9ad4e549fe97a0

SHA512
a025ddce9cf526e28bbb175ab6881404944eecdb9a7fb5050f904086df20b38d59a7b6be6b1b73b9d1b4c4d60a9547fdb3806962d9cb4c44c238689d6cb81ba8

Download Submit
\Users\Admin\saaqoq.exe

Filesize
204KB

MD5
975ebe095625e608ec1a442f2a369c66

SHA1
a085de883820ab0dc08b624e2bfc7fe4916a9c50

SHA256
5c2283e44ebc2876901d65cd49fc5fea0bfabe63b99979bc6a9ad4e549fe97a0

SHA512
a025ddce9cf526e28bbb175ab6881404944eecdb9a7fb5050f904086df20b38d59a7b6be6b1b73b9d1b4c4d60a9547fdb3806962d9cb4c44c238689d6cb81ba8

Download Submit