Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.0168eb70f996266b80de42aea1684e25.exe
Resource
win7-20231023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.0168eb70f996266b80de42aea1684e25.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
NEAS.0168eb70f996266b80de42aea1684e25.exe
-
Size
666KB
-
MD5
0168eb70f996266b80de42aea1684e25
-
SHA1
bc929f0a91cdbadef91691f241f9fc9a2517e759
-
SHA256
8fd5422b11e30fc88c25ecf70eeea184d85fef94fb85285852fac2a4ef5d1f58
-
SHA512
999f75c13eeb3f1c4cbdf0da5f1ade54898e5c79e35003cd7ce3c34c1a1fe37af9fca95cab47c29258617b296017cee13de05f67c2e9f2c99bb94af379295938
-
SSDEEP
3072:H+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:eZmqt6Qyiy3b6CR10TY8JOArF9S9
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" NEAS.0168eb70f996266b80de42aea1684e25.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers32\UT 2003 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\QuickTime 6.x Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.03 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Thief 2 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Soul Reaver 3 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\FlashGet 1.x Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid III No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Thief 3 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Shrek 2 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\ACDSee 2.4.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Hitman 3 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 5.x Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior IV No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\GeoWhere 2.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\SWiSH 2.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Medal of Honor - Allied Assault Breakthrough Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinAce 2.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior 5 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\PhotoShow 2.x Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Trinity Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Sniper Elite - Berlin 1943 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Thief III No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 No-Cd Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Hitman 2 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Winamp 2.91 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Crack.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\The Sims Superstar Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File opened for modification C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\SimCity 4 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe File created C:\Windows\SysWOW64\drivers32\Madden NFL 2004 Serial Generator.exe NEAS.0168eb70f996266b80de42aea1684e25.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4416 wrote to memory of 4276 4416 NEAS.0168eb70f996266b80de42aea1684e25.exe 113 PID 4416 wrote to memory of 4276 4416 NEAS.0168eb70f996266b80de42aea1684e25.exe 113 PID 4416 wrote to memory of 4276 4416 NEAS.0168eb70f996266b80de42aea1684e25.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0168eb70f996266b80de42aea1684e25.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0168eb70f996266b80de42aea1684e25.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\$$$$$.bat2⤵PID:4276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
666KB
MD50168eb70f996266b80de42aea1684e25
SHA1bc929f0a91cdbadef91691f241f9fc9a2517e759
SHA2568fd5422b11e30fc88c25ecf70eeea184d85fef94fb85285852fac2a4ef5d1f58
SHA512999f75c13eeb3f1c4cbdf0da5f1ade54898e5c79e35003cd7ce3c34c1a1fe37af9fca95cab47c29258617b296017cee13de05f67c2e9f2c99bb94af379295938
-
Filesize
210B
MD576afef18cfa0d9d3f0a0d7b986f5cbe6
SHA1e421f8164d54cd58d326d2eb0bdf04e01aa0bf66
SHA25621c8439406f8736905b250c15bdf331bfdedef6c85cc45e6f8952ecc5a2dc27e
SHA512d2d9cada459bd611f56465c7f932c53e87625a35bf53c1333355e6c515f328901906bc153c019582973e6bd7ae63669cf308d7e937fbeacd215097d9dfc4129f