852ba07513c087e5885fc3320332825a0cc846eda7ff3c649e77f9a1abe477dc

General

Target

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
Size

156KB
MD5

74f4e12c2d7e1f8a3d389b2dfd75d4ea
SHA1

c2d3a05c3d16d5191e4f6524768e3ed4d2412533
SHA256

852ba07513c087e5885fc3320332825a0cc846eda7ff3c649e77f9a1abe477dc
SHA512

2ac8a84e8f14d069c202b985061592e2486cedbbac1cd43e68250191efd5717a07d2213e182358d3a471d09447e8f7b9a03deb1a5f48cd21ef70f3af1eac5e86
SSDEEP

3072:/Goe5g+GwD8w2+d5bWIrJ4E5n41sSLeH8ozK/d/18UlyG4oQZiEXrA:/2WIrJ4E5n41pVN/jhFWm

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exenaaixal.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	naaixal.exe

Executes dropped EXE 1 IoCs

Processes:

naaixal.exe

pid process

2648 naaixal.exe
Loads dropped DLL 2 IoCs

Processes:

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe

pid process

2084 74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
2084 74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe

pid	process
2648	naaixal.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

naaixal.exe74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /I"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /m"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /P"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /v"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /e"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /K"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /k"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /q"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /G"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /O"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /J"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /U"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /S"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /W"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /c"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /V"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /u"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /L"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /z"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /n"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /a"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /Y"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /X"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /b"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /F"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /o"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /w"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /i"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /r"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /C"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /g"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /E"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /p"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /A"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /H"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /R"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /M"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /h"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /T"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /Z"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /f"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /j"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /A"	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /l"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /y"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /s"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /D"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /Q"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /N"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /t"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /x"	naaixal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaixal = "C:\\Users\\Admin\\naaixal.exe /B"	naaixal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exenaaixal.exe

pid	process
2084	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe
2648	naaixal.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exenaaixal.exe

pid process

2084 74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
2648 naaixal.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe

description	pid	process	target process
PID 2084 wrote to memory of 2648	2084	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe	naaixal.exe
PID 2084 wrote to memory of 2648	2084	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe	naaixal.exe
PID 2084 wrote to memory of 2648	2084	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe	naaixal.exe
PID 2084 wrote to memory of 2648	2084	74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe	naaixal.exe

C:\Users\Admin\AppData\Local\Temp\74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe
"C:\Users\Admin\AppData\Local\Temp\74f4e12c2d7e1f8a3d389b2dfd75d4ea.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\naaixal.exe
"C:\Users\Admin\naaixal.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\naaixal.exe
Filesize
156KB

MD5
832047126fef848edfb476d564667e1d

SHA1
fbaa5a45223b8f7448748c68e70f74d6bf5310aa

SHA256
dd71072a1f05c78be38350198f99aed4668eb8034b2adb3a61e5c4dba6697a71

SHA512
3a1eaae1ed7a1eda18542d71e1c4c1b4c6dab7c794b4f0569d23298fdd2b687204c9aca52b0e1fb5b98e83b85b4e08b6b9b13d47dbd73edf6eddb8064238c00f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads