21f3da750376f0c33a1e1f8c5c522faf068596140013870c45853ab846bb0458

Analysis

max time kernel
131s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9264828a96880675d66fcdf18732cb10.exe
Size

7.6MB
MD5

9264828a96880675d66fcdf18732cb10
SHA1

3c645090231ab61421e20d853b185cd841d0b3ae
SHA256

21f3da750376f0c33a1e1f8c5c522faf068596140013870c45853ab846bb0458
SHA512

7871df7e40ae01ad383a3a8c5bca5e5bbef5ea80e7f92d98661ac50a1b8ca352a6e404c6bd801dce1b271c26146be0faed246bafb4c9e668a66f51214a97d859
SSDEEP

196608:nQ4Et+a3ajx4v4sg7SsQ+LQFmAWREpGBg/Y5:nrZa3ajx4v4sgpQ+LdCpG

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	NEAS.9264828a96880675d66fcdf18732cb10.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Ver = "c72cb5da"	NEAS.9264828a96880675d66fcdf18732cb10.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\shell\open\command	NEAS.9264828a96880675d66fcdf18732cb10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou	NEAS.9264828a96880675d66fcdf18732cb10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\shell\open	NEAS.9264828a96880675d66fcdf18732cb10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\ = "Jdyou Protocol"	NEAS.9264828a96880675d66fcdf18732cb10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\EditFlags = "2"	NEAS.9264828a96880675d66fcdf18732cb10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\BrowserFlags = "8"	NEAS.9264828a96880675d66fcdf18732cb10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\shell	NEAS.9264828a96880675d66fcdf18732cb10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.9264828a96880675d66fcdf18732cb10.exe\" %1"	NEAS.9264828a96880675d66fcdf18732cb10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jdyou\URL Protocol = " "	NEAS.9264828a96880675d66fcdf18732cb10.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4612	NEAS.9264828a96880675d66fcdf18732cb10.exe
4612	NEAS.9264828a96880675d66fcdf18732cb10.exe
4612	NEAS.9264828a96880675d66fcdf18732cb10.exe
4612	NEAS.9264828a96880675d66fcdf18732cb10.exe
4612	NEAS.9264828a96880675d66fcdf18732cb10.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.9264828a96880675d66fcdf18732cb10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9264828a96880675d66fcdf18732cb10.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads