Analysis
-
max time kernel
171s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
12/11/2023, 09:45
General
-
Target
NEAS.7a122d7ae75c307301314d6ff85941c0.exe
-
Size
135KB
-
MD5
7a122d7ae75c307301314d6ff85941c0
-
SHA1
ab416cff99d47503520ba4d5473f5bcc709d5781
-
SHA256
3f88ac9d2516992a501263d7d6bb00c8616c7ba83a1947266c977b3a841b09b3
-
SHA512
ed1ca64f6930d7b61c4aaeaf1f503a188332273a947e944fcb68b00e297d4618869e5061a19f8d9db096e22c9a6958fcaa54f189ac289a1bd92413239798b1a7
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV1iFt:UVqoCl/YgjxEufVU0TbTyDDalP0t
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7a122d7ae75c307301314d6ff85941c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7a122d7ae75c307301314d6ff85941c0.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5a67bedf7dd28d81df863f40dd7e8a1f0
SHA15de62b9eabaae79266fdcf6cd2aa8ad197010c4e
SHA256e5d41a4a87d0609f9a8527e129530720784d4d3cb3a1bb1abf2c55940c81a46d
SHA512e4f8e5e85be2b89732f78fce1856787584b098f3791114dd20b102cf7ba8869183cbfe4958c181be37dcd50e834c6ee2cd8bfc230fd70725a5b5ed396806166a
-
Filesize
135KB
MD5fea08bf294ea2d37d8a9904b1641318d
SHA121cab680096c491b2a70c5aa42c385de6a01121b
SHA256e6b8a4ad24664927de24732fab08dbef8517908226822832be5a30e342d61281
SHA51248d715980eb7c3db7576fdc25a117b7ece7f9203b2659be51271b679e4383ff83afeec20f0b0fd38a8eae8a605cccb9abd3eae863338e1f9466e8e0a35ee55b0
-
Filesize
135KB
MD5fea08bf294ea2d37d8a9904b1641318d
SHA121cab680096c491b2a70c5aa42c385de6a01121b
SHA256e6b8a4ad24664927de24732fab08dbef8517908226822832be5a30e342d61281
SHA51248d715980eb7c3db7576fdc25a117b7ece7f9203b2659be51271b679e4383ff83afeec20f0b0fd38a8eae8a605cccb9abd3eae863338e1f9466e8e0a35ee55b0
-
Filesize
135KB
MD5fea08bf294ea2d37d8a9904b1641318d
SHA121cab680096c491b2a70c5aa42c385de6a01121b
SHA256e6b8a4ad24664927de24732fab08dbef8517908226822832be5a30e342d61281
SHA51248d715980eb7c3db7576fdc25a117b7ece7f9203b2659be51271b679e4383ff83afeec20f0b0fd38a8eae8a605cccb9abd3eae863338e1f9466e8e0a35ee55b0
-
Filesize
135KB
MD5ce8f4ea841bd7e7d881f74efc6bef350
SHA1ca037c583a41f5f97475331fa8d6a2b3866316ed
SHA256ed17dac491192a12a1c0dcd366a42da66a231f56d7949279384d64e20954810b
SHA512b7f5d6d72b243599363fbaccf9a8c5395d689bb35e547d3c6e7f8c729159c0dce7f1d4f19773e204a42fde2aa00359f8123fa06c55deb27ab16347ded80977ca
-
Filesize
135KB
MD5fea08bf294ea2d37d8a9904b1641318d
SHA121cab680096c491b2a70c5aa42c385de6a01121b
SHA256e6b8a4ad24664927de24732fab08dbef8517908226822832be5a30e342d61281
SHA51248d715980eb7c3db7576fdc25a117b7ece7f9203b2659be51271b679e4383ff83afeec20f0b0fd38a8eae8a605cccb9abd3eae863338e1f9466e8e0a35ee55b0
-
Filesize
135KB
MD5ce8f4ea841bd7e7d881f74efc6bef350
SHA1ca037c583a41f5f97475331fa8d6a2b3866316ed
SHA256ed17dac491192a12a1c0dcd366a42da66a231f56d7949279384d64e20954810b
SHA512b7f5d6d72b243599363fbaccf9a8c5395d689bb35e547d3c6e7f8c729159c0dce7f1d4f19773e204a42fde2aa00359f8123fa06c55deb27ab16347ded80977ca
-
Filesize
135KB
MD5a67bedf7dd28d81df863f40dd7e8a1f0
SHA15de62b9eabaae79266fdcf6cd2aa8ad197010c4e
SHA256e5d41a4a87d0609f9a8527e129530720784d4d3cb3a1bb1abf2c55940c81a46d
SHA512e4f8e5e85be2b89732f78fce1856787584b098f3791114dd20b102cf7ba8869183cbfe4958c181be37dcd50e834c6ee2cd8bfc230fd70725a5b5ed396806166a
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB