aa6a647810be0d6284d2fed5020db2fd8d084542999b63b2439fbda6b0b37603

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bea7a4b039448cce3199863260a28030_NEAS.exe
Size

86KB
MD5

bea7a4b039448cce3199863260a28030
SHA1

e28cc38271f0775ef993251eb9b57da4222650f9
SHA256

aa6a647810be0d6284d2fed5020db2fd8d084542999b63b2439fbda6b0b37603
SHA512

dfdcf66ed8580a46ad9e48d6915c1eb91ebe2df0fccba3b511b8bdf716a59881ca24221c257e471608333202378669ed860d32c153e1a0f4cbb682fddc5d997d
SSDEEP

1536:vAowfbJFgjQ284U+w2EwRz/IUqX514n2222n2n2LIEHuIUH7NOE965UfJ6n56YSR:vAowVFgjQiUkEwt/XqX514n2222n2n2y

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2268	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2268	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	bea7a4b039448cce3199863260a28030_NEAS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	bea7a4b039448cce3199863260a28030_NEAS.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2268	2912	bea7a4b039448cce3199863260a28030_NEAS.exe	28
PID 2912 wrote to memory of 2268	2912	bea7a4b039448cce3199863260a28030_NEAS.exe	28
PID 2912 wrote to memory of 2268	2912	bea7a4b039448cce3199863260a28030_NEAS.exe	28
PID 2912 wrote to memory of 2268	2912	bea7a4b039448cce3199863260a28030_NEAS.exe	28

C:\Users\Admin\AppData\Local\Temp\bea7a4b039448cce3199863260a28030_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\bea7a4b039448cce3199863260a28030_NEAS.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
86KB

MD5
cfed99fc5f58b3d498de02e2c8dfab5a

SHA1
24775b57b4fbc793626ce7c6c760596a13621d21

SHA256
764f1bbb9cfe95d828859aa3e8a131d5c9dea13a3ff798a7b4a03ecc0ae4033b

SHA512
6cef0b2a238ec62a7a57edc53124889b5cbbd3376257f57080c97d290c3d1c68f4011e7c5e622fd639b123862c829661e1810c96f9b33ac026f0e2cbc253b513

Download Submit
memory/2268-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2268-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2912-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2912-3-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2912-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads