Analysis
- max time kernel
136s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07e62b4401efdf0b975eecea942b8fd0_NEAS.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
07e62b4401efdf0b975eecea942b8fd0_NEAS.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe
- Size 6.5MB
- Sample240507-xpf3psdb79
- SHA256 0a2cba01b10301f52bffa5b720f8ccc8ac9f48b3c66c5ca67b59293b08e4e352
- MD5 07e62b4401efdf0b975eecea942b8fd0
- SHA1 0c92d90783826da598eb3c2ab5f53bf60d393deb
- SHA512 8b80ce2a1640f20f26ffc467a07a8ce8a3618145b08c4910b89517fe509858b86f0bc4ffe70d534491dcb0c82cacc000f7b94a6f5a3e78f9c469c4d27dc85d39
- SSDEEP 98304:8UqrtxKhFtYQlZ8NuzGR+Mbt9pB7wclWSV7Sxyqxr4:8Vrt8hF3j8sGRDBJwea4
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe Token: 36 2916 wmic.exe Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe Token: 36 2916 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3484 wrote to memory of 2916 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe 91 PID 3484 wrote to memory of 2916 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe 91 PID 3484 wrote to memory of 2136 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe 102 PID 3484 wrote to memory of 2136 3484 07e62b4401efdf0b975eecea942b8fd0_NEAS.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\07e62b4401efdf0b975eecea942b8fd0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\07e62b4401efdf0b975eecea942b8fd0_NEAS.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\System32\Wbem\wmic.exewmic path Win32_ComputerSystem get HypervisorPresent2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get Manufacturer2⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:536