cbfd7c0489cd666532a60056af9a4b897028872f6dde723e20ef2f3d40e358eb

Analysis

max time kernel
159s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2023 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0a7f1961580e17dc98dcbc6151782030.exe
Size

206KB
MD5

0a7f1961580e17dc98dcbc6151782030
SHA1

ab17b676e03cfab1dff0e246c6ed59982cf53891
SHA256

cbfd7c0489cd666532a60056af9a4b897028872f6dde723e20ef2f3d40e358eb
SHA512

3d9bcdc72e91a88fbc89f3b8f458101525e759033a7c430fd3114e7fd9ed9476875832e0c4d1f6551dcf44ef4650cc034f57e6816cbcab7a8cca820efb8de5e3
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4:zvEN2U+T6i5LirrllHy4HUcMQY6B

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4984	explorer.exe
5080	spoolsv.exe
1612	svchost.exe
3896	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	NEAS.0a7f1961580e17dc98dcbc6151782030.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe
4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe
4984	explorer.exe
4984	explorer.exe
1612	svchost.exe
1612	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4984	explorer.exe
1612	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe
4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe
4984	explorer.exe
4984	explorer.exe
5080	spoolsv.exe
5080	spoolsv.exe
1612	svchost.exe
1612	svchost.exe
3896	spoolsv.exe
3896	spoolsv.exe
4984	explorer.exe
4984	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4984	4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe	89
PID 4908 wrote to memory of 4984	4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe	89
PID 4908 wrote to memory of 4984	4908	NEAS.0a7f1961580e17dc98dcbc6151782030.exe	89
PID 4984 wrote to memory of 5080	4984	explorer.exe	90
PID 4984 wrote to memory of 5080	4984	explorer.exe	90
PID 4984 wrote to memory of 5080	4984	explorer.exe	90
PID 5080 wrote to memory of 1612	5080	spoolsv.exe	91
PID 5080 wrote to memory of 1612	5080	spoolsv.exe	91
PID 5080 wrote to memory of 1612	5080	spoolsv.exe	91
PID 1612 wrote to memory of 3896	1612	svchost.exe	93
PID 1612 wrote to memory of 3896	1612	svchost.exe	93
PID 1612 wrote to memory of 3896	1612	svchost.exe	93
PID 1612 wrote to memory of 2468	1612	svchost.exe	94
PID 1612 wrote to memory of 2468	1612	svchost.exe	94
PID 1612 wrote to memory of 2468	1612	svchost.exe	94
PID 1612 wrote to memory of 2052	1612	svchost.exe	117
PID 1612 wrote to memory of 2052	1612	svchost.exe	117
PID 1612 wrote to memory of 2052	1612	svchost.exe	117
PID 1612 wrote to memory of 3496	1612	svchost.exe	120
PID 1612 wrote to memory of 3496	1612	svchost.exe	120
PID 1612 wrote to memory of 3496	1612	svchost.exe	120

C:\Users\Admin\AppData\Local\Temp\NEAS.0a7f1961580e17dc98dcbc6151782030.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0a7f1961580e17dc98dcbc6151782030.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4984
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2468
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2052
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
0b1ed6388a0e561b0b95bd8f37a6b259

SHA1
8036346992a89760f00baa1fada77d755ee032c2

SHA256
f2ce0be2ae2a59937e3276ebdf89bd42051ab5b9784cea5717a1b637caf15599

SHA512
bc286d3af64fb491f1bfc2159109e08d844211c3380aef725a86bb5b6b07c8aa970ab134aaf64a17b0dc25e4c172fda0e727c0a1bc739c4c310a7c6f545769f7

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
948ac32c08365098b2882f101c44a5a5

SHA1
b6380a36ba01cdc786543093684434501b17e69c

SHA256
447eebe8062d5109128c0f86ed240c3b52ff72babaf523bfb7f428ebd700f51c

SHA512
3f1e5fe114976af6db0839a7400c96042bcdbb217c58c08c296fae28aec556fb1abbe26ffcea733d05ac52e0cd8d74bf718078b8a86e8fea72d3f784b7d580b5

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c7b1096f0ffa01a20cf4b132f7b9ab88

SHA1
bf63124d7597693fbc46d4c0f6501cfbab690a7c

SHA256
9c3915360058eace278602e93c84bda200191176bc03d292eb041b1c3540e863

SHA512
e1767f59464045bcdad7a2f1db62674c5d6e662d50d6ec044c914cb98f1f04498363ad0fd70d85d2a7b2a59e7bab05696b3211d8b9aa84ccf0e87fdc2728a280

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c7b1096f0ffa01a20cf4b132f7b9ab88

SHA1
bf63124d7597693fbc46d4c0f6501cfbab690a7c

SHA256
9c3915360058eace278602e93c84bda200191176bc03d292eb041b1c3540e863

SHA512
e1767f59464045bcdad7a2f1db62674c5d6e662d50d6ec044c914cb98f1f04498363ad0fd70d85d2a7b2a59e7bab05696b3211d8b9aa84ccf0e87fdc2728a280

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
c7b1096f0ffa01a20cf4b132f7b9ab88

SHA1
bf63124d7597693fbc46d4c0f6501cfbab690a7c

SHA256
9c3915360058eace278602e93c84bda200191176bc03d292eb041b1c3540e863

SHA512
e1767f59464045bcdad7a2f1db62674c5d6e662d50d6ec044c914cb98f1f04498363ad0fd70d85d2a7b2a59e7bab05696b3211d8b9aa84ccf0e87fdc2728a280

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
cd54c1c34ffe7d0f27e22fdbf25840a9

SHA1
d629dc18b48b6db3fbde2d226894f870d72127cb

SHA256
d4a1c42437d7e061ee9d140682fda2212e9392b60e9fe0e32f9df2cd5e59d14c

SHA512
2751427a73397ed328a2dd07a01b738912e9cb62cb7164d353cf63fa3a5671c3b5ab8159c254688f21f5063a46bb8ddbeeb5434fabaa2feeec7768bc6e423fb0

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
948ac32c08365098b2882f101c44a5a5

SHA1
b6380a36ba01cdc786543093684434501b17e69c

SHA256
447eebe8062d5109128c0f86ed240c3b52ff72babaf523bfb7f428ebd700f51c

SHA512
3f1e5fe114976af6db0839a7400c96042bcdbb217c58c08c296fae28aec556fb1abbe26ffcea733d05ac52e0cd8d74bf718078b8a86e8fea72d3f784b7d580b5

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
c7b1096f0ffa01a20cf4b132f7b9ab88

SHA1
bf63124d7597693fbc46d4c0f6501cfbab690a7c

SHA256
9c3915360058eace278602e93c84bda200191176bc03d292eb041b1c3540e863

SHA512
e1767f59464045bcdad7a2f1db62674c5d6e662d50d6ec044c914cb98f1f04498363ad0fd70d85d2a7b2a59e7bab05696b3211d8b9aa84ccf0e87fdc2728a280

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
cd54c1c34ffe7d0f27e22fdbf25840a9

SHA1
d629dc18b48b6db3fbde2d226894f870d72127cb

SHA256
d4a1c42437d7e061ee9d140682fda2212e9392b60e9fe0e32f9df2cd5e59d14c

SHA512
2751427a73397ed328a2dd07a01b738912e9cb62cb7164d353cf63fa3a5671c3b5ab8159c254688f21f5063a46bb8ddbeeb5434fabaa2feeec7768bc6e423fb0

Download Submit