Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16-11-2023 17:36
Behavioral task
behavioral1
Sample
NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
-
Size
801KB
-
MD5
eb49928c6e5be7f6c2dcfe158df9dda8
-
SHA1
7334ef0afa8ecdf497716c1309a43406138155f1
-
SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
-
SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
SSDEEP
12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MMNj:GnsJ39LyjbJkQFMhmC+6GD996
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 19 IoCs
resource yara_rule behavioral1/files/0x000900000001201b-4.dat family_runningrat behavioral1/files/0x000900000001201b-7.dat family_runningrat behavioral1/files/0x000900000001201b-6.dat family_runningrat behavioral1/files/0x000b0000000122f6-16.dat family_runningrat behavioral1/files/0x000900000001201b-10.dat family_runningrat behavioral1/memory/1716-28-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/files/0x000b0000000122f6-27.dat family_runningrat behavioral1/files/0x000b0000000122f6-23.dat family_runningrat behavioral1/files/0x000b0000000122f6-21.dat family_runningrat behavioral1/files/0x000b0000000122f6-40.dat family_runningrat behavioral1/files/0x000b0000000122f6-39.dat family_runningrat behavioral1/files/0x000a0000000155be-41.dat family_runningrat behavioral1/files/0x000a0000000155be-43.dat family_runningrat behavioral1/files/0x000a0000000155be-47.dat family_runningrat behavioral1/memory/1100-81-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/1100-85-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/1100-86-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/1100-90-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/1100-115-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat -
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OERSDs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259439677.dll" ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OERSDs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259440270.dll" ._cache_Synaptics.exe -
Executes dropped EXE 4 IoCs
pid Process 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 1100 Synaptics.exe 2872 ._cache_Synaptics.exe 2136 OERSDs.exe -
Loads dropped DLL 15 IoCs
pid Process 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 2724 svchost.exe 1100 Synaptics.exe 1100 Synaptics.exe 1100 Synaptics.exe 2872 ._cache_Synaptics.exe 2724 svchost.exe 2136 OERSDs.exe 2136 OERSDs.exe 2136 OERSDs.exe 2136 OERSDs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\OERSDs.exe svchost.exe File opened for modification C:\Windows\SysWOW64\OERSDs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OERSDs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OERSDs.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software OERSDs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft OERSDs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie OERSDs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" OERSDs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum OERSDs.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2996 PING.EXE 2040 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2660 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 2872 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe Token: SeIncBasePriorityPrivilege 2872 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 2872 ._cache_Synaptics.exe 2660 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1656 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 28 PID 1716 wrote to memory of 1656 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 28 PID 1716 wrote to memory of 1656 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 28 PID 1716 wrote to memory of 1656 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 28 PID 1716 wrote to memory of 1100 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 29 PID 1716 wrote to memory of 1100 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 29 PID 1716 wrote to memory of 1100 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 29 PID 1716 wrote to memory of 1100 1716 NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 29 PID 1100 wrote to memory of 2872 1100 Synaptics.exe 32 PID 1100 wrote to memory of 2872 1100 Synaptics.exe 32 PID 1100 wrote to memory of 2872 1100 Synaptics.exe 32 PID 1100 wrote to memory of 2872 1100 Synaptics.exe 32 PID 1656 wrote to memory of 816 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 33 PID 1656 wrote to memory of 816 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 33 PID 1656 wrote to memory of 816 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 33 PID 1656 wrote to memory of 816 1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe 33 PID 816 wrote to memory of 2996 816 cmd.exe 35 PID 816 wrote to memory of 2996 816 cmd.exe 35 PID 816 wrote to memory of 2996 816 cmd.exe 35 PID 816 wrote to memory of 2996 816 cmd.exe 35 PID 2872 wrote to memory of 2612 2872 ._cache_Synaptics.exe 36 PID 2872 wrote to memory of 2612 2872 ._cache_Synaptics.exe 36 PID 2872 wrote to memory of 2612 2872 ._cache_Synaptics.exe 36 PID 2872 wrote to memory of 2612 2872 ._cache_Synaptics.exe 36 PID 2612 wrote to memory of 2040 2612 cmd.exe 38 PID 2612 wrote to memory of 2040 2612 cmd.exe 38 PID 2612 wrote to memory of 2040 2612 cmd.exe 38 PID 2612 wrote to memory of 2040 2612 cmd.exe 38 PID 2724 wrote to memory of 2136 2724 svchost.exe 39 PID 2724 wrote to memory of 2136 2724 svchost.exe 39 PID 2724 wrote to memory of 2136 2724 svchost.exe 39 PID 2724 wrote to memory of 2136 2724 svchost.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 14⤵
- Runs ping.exe
PID:2996
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 15⤵
- Runs ping.exe
PID:2040
-
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "OERSDs"1⤵PID:2160
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "OERSDs"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\OERSDs.exeC:\Windows\system32\OERSDs.exe "c:\users\admin\appdata\local\temp\259439677.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2136
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
801KB
MD5eb49928c6e5be7f6c2dcfe158df9dda8
SHA17334ef0afa8ecdf497716c1309a43406138155f1
SHA2561db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA51272ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
48KB
MD5baaa08a9723edf38c38fca9f245e06d3
SHA1bd8c6db41444c29b5380ce8e819cad0cff1b87a6
SHA256bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797
SHA5120d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
25KB
MD5e454c59b2616686f92b20d733ab0db1f
SHA1af744f4d209466878b045f879e2e6d2e85624839
SHA25601b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc
SHA512b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d