Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7a93c38768034a30441090b0f4ff6600_NEAS.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a93c38768034a30441090b0f4ff6600_NEAS.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7a93c38768034a30441090b0f4ff6600_NEAS.exe
-
Size
156KB
-
MD5
7a93c38768034a30441090b0f4ff6600
-
SHA1
e5676575bbf4c99779adece6b8d66596e700fd43
-
SHA256
be87599de25a40268780c5bf7f38a1fad7bb1f87c4724d4c870093e544c69fd9
-
SHA512
840ed06b433e8bdc69d09ae1adbb78e70e81af98eaf73d367af388af6ba629bb55a5ea3439e7ba788deb7553503079cc5d806a1ed4a92f410295fee643e34d8a
-
SSDEEP
3072:z5EGVHCzwrCaHHvhtbz0wXtV2eZDEUXni7fo7KSif8xWM33r3k1jTCZU4oQZiE3R:yGFCzwrCW/0AHa8nuo7KSif8xWM33r34
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7a93c38768034a30441090b0f4ff6600_NEAS.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hioyaok.exe -
Executes dropped EXE 1 IoCs
pid Process 2968 hioyaok.exe -
Loads dropped DLL 2 IoCs
pid Process 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /W" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /F" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /S" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /I" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /Q" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /i" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /g" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /K" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /k" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /G" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /a" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /n" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /N" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /Z" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /D" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /f" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /O" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /d" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /R" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /C" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /l" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /v" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /P" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /e" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /V" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /h" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /b" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /j" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /U" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /Y" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /y" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /w" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /p" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /J" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /s" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /Y" 7a93c38768034a30441090b0f4ff6600_NEAS.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /X" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /t" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /E" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /L" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /r" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /c" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /B" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /H" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /A" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /x" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /T" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /o" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /m" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /q" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /z" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /M" hioyaok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hioyaok = "C:\\Users\\Admin\\hioyaok.exe /u" hioyaok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe 2968 hioyaok.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 2968 hioyaok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2968 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 28 PID 2916 wrote to memory of 2968 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 28 PID 2916 wrote to memory of 2968 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 28 PID 2916 wrote to memory of 2968 2916 7a93c38768034a30441090b0f4ff6600_NEAS.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a93c38768034a30441090b0f4ff6600_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\7a93c38768034a30441090b0f4ff6600_NEAS.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\hioyaok.exe"C:\Users\Admin\hioyaok.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD59984bf0cbe3035eb433303b2c462f5f5
SHA1ebd4155d3a6ce772a75133b6b37921aefd113d3e
SHA256d1b607865035dfefba1861284866568026c9644d10aad8e135b93772aa145b79
SHA512cbb47b87f51606102f0ecc2eb0179a858e779e06be924d7d5ddb9f4d92e17cd60bc271c1030c187287109cee82aa7a20816f2b70d5f5d733596d59602a742d02