2e1c0e7a8760240f1053f484d2182cd29840a1132b95dae1c48d2e60b331e68a

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
Size

135KB
MD5

dc67e1448e16e3b3aeed6c6ef246eb70
SHA1

01e6a3542494d4ff4f6bcbc860b4e35dc217ecf8
SHA256

2e1c0e7a8760240f1053f484d2182cd29840a1132b95dae1c48d2e60b331e68a
SHA512

b9341e838bd503f911a3ef818202ffda52d41507ef4e790720f6f726f567114a2271168a89b891827484ea6a4f2a825c634cd3d8197814f55d00e7a5e3945dc4
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0a:UVqoCl/YgjxEufVU0TbTyDDal6a

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1696	explorer.exe
2064	spoolsv.exe
756	svchost.exe
672	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
1696	explorer.exe
2064	spoolsv.exe
756	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2768	schtasks.exe
2944	schtasks.exe
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
756	svchost.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
756	svchost.exe
756	svchost.exe
1696	explorer.exe
756	svchost.exe
1696	explorer.exe
756	svchost.exe
1696	explorer.exe
756	svchost.exe
1696	explorer.exe
756	svchost.exe
1696	explorer.exe
756	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1696	explorer.exe
756	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
1696	explorer.exe
1696	explorer.exe
2064	spoolsv.exe
2064	spoolsv.exe
756	svchost.exe
756	svchost.exe
672	spoolsv.exe
672	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1696	2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe	28
PID 2248 wrote to memory of 1696	2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe	28
PID 2248 wrote to memory of 1696	2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe	28
PID 2248 wrote to memory of 1696	2248	NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe	28
PID 1696 wrote to memory of 2064	1696	explorer.exe	29
PID 1696 wrote to memory of 2064	1696	explorer.exe	29
PID 1696 wrote to memory of 2064	1696	explorer.exe	29
PID 1696 wrote to memory of 2064	1696	explorer.exe	29
PID 2064 wrote to memory of 756	2064	spoolsv.exe	30
PID 2064 wrote to memory of 756	2064	spoolsv.exe	30
PID 2064 wrote to memory of 756	2064	spoolsv.exe	30
PID 2064 wrote to memory of 756	2064	spoolsv.exe	30
PID 756 wrote to memory of 672	756	svchost.exe	31
PID 756 wrote to memory of 672	756	svchost.exe	31
PID 756 wrote to memory of 672	756	svchost.exe	31
PID 756 wrote to memory of 672	756	svchost.exe	31
PID 1696 wrote to memory of 980	1696	explorer.exe	32
PID 1696 wrote to memory of 980	1696	explorer.exe	32
PID 1696 wrote to memory of 980	1696	explorer.exe	32
PID 1696 wrote to memory of 980	1696	explorer.exe	32
PID 756 wrote to memory of 2768	756	svchost.exe	33
PID 756 wrote to memory of 2768	756	svchost.exe	33
PID 756 wrote to memory of 2768	756	svchost.exe	33
PID 756 wrote to memory of 2768	756	svchost.exe	33
PID 756 wrote to memory of 2944	756	svchost.exe	38
PID 756 wrote to memory of 2944	756	svchost.exe	38
PID 756 wrote to memory of 2944	756	svchost.exe	38
PID 756 wrote to memory of 2944	756	svchost.exe	38
PID 756 wrote to memory of 2600	756	svchost.exe	40
PID 756 wrote to memory of 2600	756	svchost.exe	40
PID 756 wrote to memory of 2600	756	svchost.exe	40
PID 756 wrote to memory of 2600	756	svchost.exe	40

C:\Users\Admin\AppData\Local\Temp\NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dc67e1448e16e3b3aeed6c6ef246eb70.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:756
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:26 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:27 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2944
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:28 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2600
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
d0e9c106f8a7f9e73620d8e4a59118b0

SHA1
b5de62df0c6629482ab136e2403908354f315071

SHA256
8fe48b722d318e953a6c65d57abab36cd5a209e787224d5022b7496bf90c79ae

SHA512
864003df85bfb94ea2e5c4741edc2e62bdd8c9b18d71691020fd49918ad6fed2491fd10eb7d3c99c197f2bb86a24236d09e00839db560dced2b93dd27f7f7b53

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
ac375826066054b4ac50c3d1a803c68f

SHA1
05807433c15c7f3f229d4cd88f6323f6b7fda181

SHA256
b0398799112156cf7d96eefd9121b86e0f890c4cd8ba2a88a6f3bc49af48be7b

SHA512
af3a8210452d53ca6f292adde759d39f7374f18eb1a38d6e62806369099798f775a916e123062a8d5450ba3222a0ab84d22ed393065138bbb9ce5ad2f09d67a1

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
ac375826066054b4ac50c3d1a803c68f

SHA1
05807433c15c7f3f229d4cd88f6323f6b7fda181

SHA256
b0398799112156cf7d96eefd9121b86e0f890c4cd8ba2a88a6f3bc49af48be7b

SHA512
af3a8210452d53ca6f292adde759d39f7374f18eb1a38d6e62806369099798f775a916e123062a8d5450ba3222a0ab84d22ed393065138bbb9ce5ad2f09d67a1

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
d0e9c106f8a7f9e73620d8e4a59118b0

SHA1
b5de62df0c6629482ab136e2403908354f315071

SHA256
8fe48b722d318e953a6c65d57abab36cd5a209e787224d5022b7496bf90c79ae

SHA512
864003df85bfb94ea2e5c4741edc2e62bdd8c9b18d71691020fd49918ad6fed2491fd10eb7d3c99c197f2bb86a24236d09e00839db560dced2b93dd27f7f7b53

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
d0e9c106f8a7f9e73620d8e4a59118b0

SHA1
b5de62df0c6629482ab136e2403908354f315071

SHA256
8fe48b722d318e953a6c65d57abab36cd5a209e787224d5022b7496bf90c79ae

SHA512
864003df85bfb94ea2e5c4741edc2e62bdd8c9b18d71691020fd49918ad6fed2491fd10eb7d3c99c197f2bb86a24236d09e00839db560dced2b93dd27f7f7b53

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cb689efc0553f9d7e51f88be084801f8

SHA1
7ffe89e1595bc2caa110f6e0ddff8ee617a205f1

SHA256
4a7792e6faecaa6920dd5b0bd9e05384e87b5384cbda907809cd6fb525c668e0

SHA512
2601ba9d8c6486abb26d1bf885798f1fcf26c979fe48019a191ee5a6e9a694a9200042566ddaee5f19536497854a7ce36b97bc995744981d853268a27ee2aa47

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
ac375826066054b4ac50c3d1a803c68f

SHA1
05807433c15c7f3f229d4cd88f6323f6b7fda181

SHA256
b0398799112156cf7d96eefd9121b86e0f890c4cd8ba2a88a6f3bc49af48be7b

SHA512
af3a8210452d53ca6f292adde759d39f7374f18eb1a38d6e62806369099798f775a916e123062a8d5450ba3222a0ab84d22ed393065138bbb9ce5ad2f09d67a1

Download Submit
memory/672-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/756-38-0x0000000000310000-0x000000000032F000-memory.dmp

Filesize
124KB

Download
memory/2064-31-0x00000000002B0000-0x00000000002CF000-memory.dmp

Filesize
124KB

Download
memory/2064-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2248-9-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/2248-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2248-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download