Analysis
-
max time kernel
175s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe
-
Size
83KB
-
MD5
d717c18dee94c6ec30eb862e25ab0b51
-
SHA1
c61a55387e51b21bfc0449e18a4a135afac66fd8
-
SHA256
a6ae6decb25e65e56a07f6d70ca411b88b1efaa2ec840bda729c9b35ad097204
-
SHA512
0dc4ccb5f10c4e819532674b64b460b4bfce0caa6209dd6320ca95a5435ba2947f3dfce8de88c1d2eb682f8fd531d04a1fc112def2021abcc0c40e604d961ff6
-
SSDEEP
1536:/Ao0zj2d6rnJYulBJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nz:/AoAliulHnJBSX1nV1b1N1Il1k1YFI1M
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2496 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2496 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\HidePlugin.dll microsofthelp.exe File created C:\Windows\microsofthelp.exe NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2496 2688 NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe 29 PID 2688 wrote to memory of 2496 2688 NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe 29 PID 2688 wrote to memory of 2496 2688 NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe 29 PID 2688 wrote to memory of 2496 2688 NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d717c18dee94c6ec30eb862e25ab0b51.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD532b7e986dd691153766840933ef45006
SHA1fded0a00bc1cc6a89cd747d8ddb921199fb13fe7
SHA2566b014cbdbd040aa9814ce5228f3d51f0f853854cd98ab16e1b29521007dd5bb1
SHA512dabe19090d1ecc3ea32f8bf602e26c21ea515a60266d35f97871349050e2b5bd12332c6a9eca5243730333232b240e79592f2ec463bc208cdf5edbe1ef79f106
-
Filesize
83KB
MD532b7e986dd691153766840933ef45006
SHA1fded0a00bc1cc6a89cd747d8ddb921199fb13fe7
SHA2566b014cbdbd040aa9814ce5228f3d51f0f853854cd98ab16e1b29521007dd5bb1
SHA512dabe19090d1ecc3ea32f8bf602e26c21ea515a60266d35f97871349050e2b5bd12332c6a9eca5243730333232b240e79592f2ec463bc208cdf5edbe1ef79f106
-
Filesize
83KB
MD532b7e986dd691153766840933ef45006
SHA1fded0a00bc1cc6a89cd747d8ddb921199fb13fe7
SHA2566b014cbdbd040aa9814ce5228f3d51f0f853854cd98ab16e1b29521007dd5bb1
SHA512dabe19090d1ecc3ea32f8bf602e26c21ea515a60266d35f97871349050e2b5bd12332c6a9eca5243730333232b240e79592f2ec463bc208cdf5edbe1ef79f106