Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2023 10:37

General

  • Target

    NEAS.a5c63e560b29d86f59e932cb1967bc60.exe

  • Size

    742KB

  • MD5

    a5c63e560b29d86f59e932cb1967bc60

  • SHA1

    2deaf371f59fabb2c483c32d711eb594cfdad007

  • SHA256

    aa09ca2d5591d13eeab08ab0b2f6921031a341f577cc13a8a7ac96c9c43eeed0

  • SHA512

    fbafbd93612296da99579004f9427c59316a52ece230e24848ecc95240c9a853158da6e238734c912f58de620808adece20728163c127cc4b567518da7e481c2

  • SSDEEP

    12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1F/:lIt4kt0Kd6F6CNzYhUiEWEYcwH

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a5c63e560b29d86f59e932cb1967bc60.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a5c63e560b29d86f59e932cb1967bc60.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2196
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1448
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2748
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2656
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2820
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:39 /f
            5⤵
            • Creates scheduled task(s)
            PID:2664
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:40 /f
            5⤵
            • Creates scheduled task(s)
            PID:3008
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:41 /f
            5⤵
            • Creates scheduled task(s)
            PID:1908
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      741KB

      MD5

      bd5d39cb52ed2592d01f6af9c5afc6e8

      SHA1

      30d60ff95715bc5c1d4979f1d44f6dca19282785

      SHA256

      42a57cd647de81302809ccf2f43636193f5dfadd570577ae28e6d62265f1f14a

      SHA512

      db472cbaac243c0cc174e81a3aef8323f5391857945179aba23157907cc57eda5eeba85cc101ca83a62a117fbc1cb91cddfb30e5eba245b475106b296b1441c2

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • C:\Windows\Resources\svchost.exe

      Filesize

      741KB

      MD5

      8fc015f5b8f1480ebd27f515c2b3b918

      SHA1

      135d1f9392d0b552468e04fce89b1e96cc3b436c

      SHA256

      b55edc4264ed726ba664ba3b12d3e1db207deb45a4f67a277f36296d71f30b68

      SHA512

      b5496d25d06290752da74895bd871f63868a80b21c80955f6fa7c6af496e7fbc9cd4481aae1eaf09f35fe71183b18cc28d0eb750f3ddae0898016755c151baa2

    • \??\c:\windows\resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • \??\c:\windows\resources\svchost.exe

      Filesize

      741KB

      MD5

      8fc015f5b8f1480ebd27f515c2b3b918

      SHA1

      135d1f9392d0b552468e04fce89b1e96cc3b436c

      SHA256

      b55edc4264ed726ba664ba3b12d3e1db207deb45a4f67a277f36296d71f30b68

      SHA512

      b5496d25d06290752da74895bd871f63868a80b21c80955f6fa7c6af496e7fbc9cd4481aae1eaf09f35fe71183b18cc28d0eb750f3ddae0898016755c151baa2

    • \??\c:\windows\resources\themes\explorer.exe

      Filesize

      741KB

      MD5

      bd5d39cb52ed2592d01f6af9c5afc6e8

      SHA1

      30d60ff95715bc5c1d4979f1d44f6dca19282785

      SHA256

      42a57cd647de81302809ccf2f43636193f5dfadd570577ae28e6d62265f1f14a

      SHA512

      db472cbaac243c0cc174e81a3aef8323f5391857945179aba23157907cc57eda5eeba85cc101ca83a62a117fbc1cb91cddfb30e5eba245b475106b296b1441c2

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      741KB

      MD5

      bd5d39cb52ed2592d01f6af9c5afc6e8

      SHA1

      30d60ff95715bc5c1d4979f1d44f6dca19282785

      SHA256

      42a57cd647de81302809ccf2f43636193f5dfadd570577ae28e6d62265f1f14a

      SHA512

      db472cbaac243c0cc174e81a3aef8323f5391857945179aba23157907cc57eda5eeba85cc101ca83a62a117fbc1cb91cddfb30e5eba245b475106b296b1441c2

    • \Windows\Resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • \Windows\Resources\spoolsv.exe

      Filesize

      742KB

      MD5

      582e2c6e1f992691ae05d77c1114bb5a

      SHA1

      071d4ace443f3114eca6b09f71269817ef19a806

      SHA256

      3e3034c65b2b13d0b497be6495195975e94f950a577eb99a65de004d03fd4ca0

      SHA512

      2a956d2b9cf34868763840c2acc5d6f3b9f4f2a57b30ce88a9b80d3389cf660ad2e31e8c324362b404beb76c33e94825a684b21ed2340c716cc0604a57a36397

    • \Windows\Resources\svchost.exe

      Filesize

      741KB

      MD5

      8fc015f5b8f1480ebd27f515c2b3b918

      SHA1

      135d1f9392d0b552468e04fce89b1e96cc3b436c

      SHA256

      b55edc4264ed726ba664ba3b12d3e1db207deb45a4f67a277f36296d71f30b68

      SHA512

      b5496d25d06290752da74895bd871f63868a80b21c80955f6fa7c6af496e7fbc9cd4481aae1eaf09f35fe71183b18cc28d0eb750f3ddae0898016755c151baa2

    • memory/1448-57-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-65-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-69-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-11-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-67-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-61-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-54-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-53-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/1448-51-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-0-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-48-0x0000000003850000-0x0000000003BC2000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-49-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-50-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-10-0x0000000003850000-0x0000000003BC2000-memory.dmp

      Filesize

      3.4MB

    • memory/2196-47-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-60-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-33-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-56-0x0000000003740000-0x0000000003AB2000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-80-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-52-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-74-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-64-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-70-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-39-0x0000000003740000-0x0000000003AB2000-memory.dmp

      Filesize

      3.4MB

    • memory/2656-68-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2748-32-0x0000000003700000-0x0000000003A72000-memory.dmp

      Filesize

      3.4MB

    • memory/2748-46-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2820-41-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2820-45-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB