Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
5be9acaebf27218731ef9bfca990b9f0_NEAS.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5be9acaebf27218731ef9bfca990b9f0_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
5be9acaebf27218731ef9bfca990b9f0_NEAS.exe
-
Size
3.6MB
-
MD5
5be9acaebf27218731ef9bfca990b9f0
-
SHA1
903185395cf0bb739612903a048788538517c65a
-
SHA256
fda373f32ac00a6d88ffb7ccfac41df243b8b6e42234d22b90b97cf385d70010
-
SHA512
a0b2d8b1a1d07dcdc1c012f1abd416597d4ff7d275ad9604b8a025a8ad4f53744cfcc63621a9b56ddf05779f930807fdcc34258b0aa2ceae7337ff9ba700028c
-
SSDEEP
49152:ksgY1bXNn4iM1mo7JFAU9YfLxd4cY1DJmXTHX1bLu1LriJzf64iVDJEY:5gwrNn4Yo7Lefb4cY1DY5bL4Lrc7NaJ3
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe -
Checks BIOS information in registry 2 TTPs 15 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
pid Process 4124 explorer.exe 3256 spoolsv.exe 5108 svchost.exe 4808 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 explorer.exe File opened for modification \??\PhysicalDrive0 spoolsv.exe File opened for modification \??\PhysicalDrive0 svchost.exe File opened for modification \??\PhysicalDrive0 spoolsv.exe File opened for modification \??\PhysicalDrive0 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 4124 explorer.exe 3256 spoolsv.exe 5108 svchost.exe 4808 spoolsv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe 4124 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4124 explorer.exe 5108 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 4124 explorer.exe 4124 explorer.exe 3256 spoolsv.exe 3256 spoolsv.exe 5108 svchost.exe 5108 svchost.exe 4808 spoolsv.exe 4808 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 908 wrote to memory of 4124 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 84 PID 908 wrote to memory of 4124 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 84 PID 908 wrote to memory of 4124 908 5be9acaebf27218731ef9bfca990b9f0_NEAS.exe 84 PID 4124 wrote to memory of 3256 4124 explorer.exe 87 PID 4124 wrote to memory of 3256 4124 explorer.exe 87 PID 4124 wrote to memory of 3256 4124 explorer.exe 87 PID 3256 wrote to memory of 5108 3256 spoolsv.exe 88 PID 3256 wrote to memory of 5108 3256 spoolsv.exe 88 PID 3256 wrote to memory of 5108 3256 spoolsv.exe 88 PID 5108 wrote to memory of 4808 5108 svchost.exe 89 PID 5108 wrote to memory of 4808 5108 svchost.exe 89 PID 5108 wrote to memory of 4808 5108 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5be9acaebf27218731ef9bfca990b9f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\5be9acaebf27218731ef9bfca990b9f0_NEAS.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4808
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD554fd8ae71831d9afc54c3b3a9cad01e8
SHA1c8cd04c1fd27990aaaf98c16d28d9fddaa61beb5
SHA256143ac77670384287b780c744a95ce45e95b28747cdc93a75069be8ffb8da2962
SHA512de6fb3af41c9b3831625935c29998f106bd9361edb13a1b9ce02f5295298b17771e9bf01dec7ca749ff00b517de9e6ea77935185c1081a1795cbf0e69af17f40
-
Filesize
3.6MB
MD5139178e392b2602875ab8ce4af7488ac
SHA1179287f8fcce04b4c2e5686caee81a3e4d7b790f
SHA2565b962906bd37088b17c8110499e86dc46503ebf402526377c43a30e625e06e35
SHA5124589625c8559b7aae3e5d62c093e1024e637adfa7f47add2450afe889ebc213acec465cf0adf85c61e3027665a81deb1485a843c03d000777f9c68c10248e932
-
Filesize
3.6MB
MD533f2c816df6345bfb2ededf64fb3b7a0
SHA1d768448c2fe5346d371abdaca7006b8bd147a3e9
SHA2564dfafc3b98726572e892f994062133d333dd61de7fb1fee7be1b0651d1c46dc3
SHA512bec0d495ed66d57c189aa5cb6615fa818369b0f3969109e27232a80581b3681e5bc01b4c158f547f9fe82127e8cae71a04a9e83d30754253e69e436346da3c62
-
Filesize
3.6MB
MD56cbdf3dc3924066e9f1f40ecd80d6e48
SHA1b0652f24d44baf5deb9ff47a24ad6ca9443d58f9
SHA256147d8eade5540ac3ed9826a218252b8f24f16c721295b0ecf48edf7f005714d3
SHA5127ec3e0bdaaf3f29ab5d786380155679824275eb7d028899d7402707820d0fea257badba8410ca7365a5bb27d1b3cff64a0683eea9f18cd490fcb8b07fada7f44