Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 20:04
Behavioral task
behavioral1
Sample
neroAacEnc.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
neroAacEnc.exe
Resource
win10v2004-20240709-en
General
-
Target
neroAacEnc.exe
-
Size
15.2MB
-
MD5
9bf782afcc591d031b253116ac34051b
-
SHA1
901764258a8f7322c9a4155f70e48e9676c7691e
-
SHA256
318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d
-
SHA512
dacc38e7d1fd9d60b6700ed5d28d2aa3283766157e84399f9e6b98161d399b32a8c8ea6846ec932b4c8a13e3690c7b2bc6db17d62f47d9ac22f74cf8dc59400c
-
SSDEEP
393216:Lwi3tIkSzBOms76P5jAkCQBIVO3JDps+ziMlbMhrC+lFaiNFjU7AWt:BtuOu5AFQ+0ps++MlAn61
Malware Config
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1544-0-0x0000000000400000-0x0000000001484000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\0BB94212\ImagePath = "C:\\Windows\\SysWOW64\\explorer.exe" explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3352 cmd.exe -
Drops file in System32 directory 3 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl explorer.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
neroAacEnc.exedescription pid process target process PID 1544 set thread context of 3352 1544 neroAacEnc.exe cmd.exe -
Drops file in Program Files directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
neroAacEnc.execmd.exeexplorer.exeexplorer.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neroAacEnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz explorer.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor explorer.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 explorer.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString explorer.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c135975360e0da01 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007d5c9c5360e0da01 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d420200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{11DBB47C-A525-400B-9E80-A54615A090C0} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 0100000000000000d159fb5360e0da01 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
neroAacEnc.execmd.exeexplorer.exepowershell.exepid process 1544 neroAacEnc.exe 1544 neroAacEnc.exe 3352 cmd.exe 3352 cmd.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 792 powershell.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 792 powershell.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe 4836 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
neroAacEnc.execmd.exepid process 1544 neroAacEnc.exe 3352 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 792 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
neroAacEnc.execmd.exeexplorer.exedescription pid process target process PID 1544 wrote to memory of 3352 1544 neroAacEnc.exe cmd.exe PID 1544 wrote to memory of 3352 1544 neroAacEnc.exe cmd.exe PID 1544 wrote to memory of 3352 1544 neroAacEnc.exe cmd.exe PID 1544 wrote to memory of 3352 1544 neroAacEnc.exe cmd.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 3352 wrote to memory of 4836 3352 cmd.exe explorer.exe PID 4836 wrote to memory of 792 4836 explorer.exe powershell.exe PID 4836 wrote to memory of 792 4836 explorer.exe powershell.exe PID 4836 wrote to memory of 792 4836 explorer.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\neroAacEnc.exe"C:\Users\Admin\AppData\Local\Temp\neroAacEnc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Sets service image path in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Windows\SysWOW64\explorer.exe4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2738778dFilesize
14.6MB
MD561aa8acf927cbad9f4ca0acd6292a3ba
SHA1c3b35f5ac2b84feb6a9dea742b26580bef92ccb0
SHA256b19eba3e540bdb64f4f751153d21ce767e405f210689591636ecd3ed2c90206f
SHA512d981110333fa531be5aa134769607ef58987bafab92a8dd755d130ef8af1603302d49a9c816e75e600d1ffc1284f07f2d79fda02fb3a608ba3df0db6a8cd28fd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1draqwe5.afm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/792-58-0x0000000007A90000-0x000000000810A000-memory.dmpFilesize
6.5MB
-
memory/792-41-0x0000000005C50000-0x0000000005FA4000-memory.dmpFilesize
3.3MB
-
memory/792-29-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/792-30-0x0000000005AE0000-0x0000000005B46000-memory.dmpFilesize
408KB
-
memory/792-66-0x0000000007770000-0x0000000007778000-memory.dmpFilesize
32KB
-
memory/792-65-0x0000000007790000-0x00000000077AA000-memory.dmpFilesize
104KB
-
memory/792-64-0x0000000007690000-0x00000000076A4000-memory.dmpFilesize
80KB
-
memory/792-63-0x0000000007680000-0x000000000768E000-memory.dmpFilesize
56KB
-
memory/792-62-0x0000000007650000-0x0000000007661000-memory.dmpFilesize
68KB
-
memory/792-61-0x00000000076D0000-0x0000000007766000-memory.dmpFilesize
600KB
-
memory/792-60-0x00000000074C0000-0x00000000074CA000-memory.dmpFilesize
40KB
-
memory/792-59-0x0000000007450000-0x000000000746A000-memory.dmpFilesize
104KB
-
memory/792-57-0x0000000007330000-0x00000000073D3000-memory.dmpFilesize
652KB
-
memory/792-56-0x0000000006710000-0x000000000672E000-memory.dmpFilesize
120KB
-
memory/792-46-0x0000000075A20000-0x0000000075A6C000-memory.dmpFilesize
304KB
-
memory/792-45-0x00000000066D0000-0x0000000006702000-memory.dmpFilesize
200KB
-
memory/792-43-0x0000000006170000-0x00000000061BC000-memory.dmpFilesize
304KB
-
memory/792-26-0x0000000004B80000-0x0000000004BB6000-memory.dmpFilesize
216KB
-
memory/792-27-0x00000000052D0000-0x00000000058F8000-memory.dmpFilesize
6.2MB
-
memory/792-28-0x0000000005160000-0x0000000005182000-memory.dmpFilesize
136KB
-
memory/792-42-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/1544-0-0x0000000000400000-0x0000000001484000-memory.dmpFilesize
16.5MB
-
memory/1544-1-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/1544-5-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/1544-4-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/1544-2-0x00007FF80F250000-0x00007FF80F445000-memory.dmpFilesize
2.0MB
-
memory/1544-3-0x0000000075762000-0x0000000075764000-memory.dmpFilesize
8KB
-
memory/3352-9-0x00007FF80F250000-0x00007FF80F445000-memory.dmpFilesize
2.0MB
-
memory/3352-16-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/3352-7-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/3352-11-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/3352-12-0x0000000075750000-0x00000000758CB000-memory.dmpFilesize
1.5MB
-
memory/4836-44-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-17-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-18-0x00007FF80F250000-0x00007FF80F445000-memory.dmpFilesize
2.0MB
-
memory/4836-21-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-19-0x0000000063280000-0x00000000634BE000-memory.dmpFilesize
2.2MB
-
memory/4836-23-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-24-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-20-0x000000006E600000-0x000000006E69D000-memory.dmpFilesize
628KB
-
memory/4836-69-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-71-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB
-
memory/4836-76-0x0000000001200000-0x0000000002011000-memory.dmpFilesize
14.1MB