d07e617f6192468282ae6de911c38f658cba9e327fd6453293a72d6e96ef25ba

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
Size

958KB
MD5

f9ad9c07bd8a45637bc14ee804c5aaf0
SHA1

12c355469dfa499e8aca6096d57f8053a89bfd73
SHA256

d07e617f6192468282ae6de911c38f658cba9e327fd6453293a72d6e96ef25ba
SHA512

f7742a174c80e03c722bc86e8379e944cfb6b940687277ba57b1ae8332ce804e4455c13dc174339ece24bf570a8ed0f0231d93fe79e9e08a04a676b66863f9df
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjw75W6vfH2i1wp:Hha8iAx+1zwjJHd6vB/75W6XmVs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
File created	C:\Windows\SysWOW64\GAAG.exe	NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f9ad9c07bd8a45637bc14ee804c5aaf0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
967KB

MD5
af1cfd0fce4a48ad5a76ce24fdaa4e23

SHA1
faab243290a64ed653184bf966206e4d1cffb933

SHA256
fe9709e418e035082ff2970c87caf3c624f53b76596fe1f91d9955a62c91576a

SHA512
8d271ba786953ab5a0edc14012dbdbf1a77fc3bf94c999d37c2f96cf25591da25a5abe790cfe08f406e1fa0fa2fc8db302fbbe14e77d2113e64539c3750c065e

Download Submit
memory/2564-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2564-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads