df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67

General

Target

NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
Size

17.5MB
MD5

2ceba1e2864f7965a9154c54c75db8d5
SHA1

da53dc70059f5697d2bd0a58c7a9423e240b2194
SHA256

df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67
SHA512

dad34912bb55c1ebe2ae7fad729de5bdc3366a826985e20ddb45f538bf64fc13023d7d01400abbbbc69a97b2234ef0f27f3109772e86325d56a86316d87b2fa4
SSDEEP

393216:8W7yDgR8mOUmAUrLEeBh8TmLynyH09kW2elluldA805:NyMRxC8GomLpH7e7mdJq

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe = "11000"	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
2968	NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.df88d6502e133a163ef59dc961ed51e8b185e769ef1d0568d7df76936bed1d67.exe"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2968-2-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2968-5-0x0000000140000000-0x0000000141D80000-memory.dmp

Filesize
29.5MB

Download
memory/2968-6-0x0000000077A60000-0x0000000077A62000-memory.dmp

Filesize
8KB

Download
memory/2968-4-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2968-8-0x0000000077A60000-0x0000000077A62000-memory.dmp

Filesize
8KB

Download
memory/2968-10-0x0000000077A60000-0x0000000077A62000-memory.dmp

Filesize
8KB

Download
memory/2968-11-0x0000000077A70000-0x0000000077A72000-memory.dmp

Filesize
8KB

Download
memory/2968-13-0x0000000140000000-0x0000000141D80000-memory.dmp

Filesize
29.5MB

Download
memory/2968-14-0x0000000077A70000-0x0000000077A72000-memory.dmp

Filesize
8KB

Download
memory/2968-17-0x0000000077A70000-0x0000000077A72000-memory.dmp

Filesize
8KB

Download
memory/2968-16-0x0000000077890000-0x0000000077A39000-memory.dmp

Filesize
1.7MB

Download
memory/2968-18-0x0000000077A80000-0x0000000077A82000-memory.dmp

Filesize
8KB

Download
memory/2968-20-0x0000000077A80000-0x0000000077A82000-memory.dmp

Filesize
8KB

Download
memory/2968-22-0x0000000077A80000-0x0000000077A82000-memory.dmp

Filesize
8KB

Download
memory/2968-23-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2968-25-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2968-27-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2968-32-0x000007FEFD950000-0x000007FEFD952000-memory.dmp

Filesize
8KB

Download
memory/2968-30-0x000007FEFD950000-0x000007FEFD952000-memory.dmp

Filesize
8KB

Download
memory/2968-35-0x000007FEFD960000-0x000007FEFD962000-memory.dmp

Filesize
8KB

Download
memory/2968-37-0x000007FEFD960000-0x000007FEFD962000-memory.dmp

Filesize
8KB

Download
memory/2968-58-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

Filesize
64KB

Download
memory/2968-66-0x0000000140000000-0x0000000141D80000-memory.dmp

Filesize
29.5MB

Download
memory/2968-67-0x0000000077890000-0x0000000077A39000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing