597d6fcc25692a52f7a0aa4300739bff76f289dd6e6087d2ed2d71ba0101a008

Analysis

max time kernel
152s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Size

482KB
MD5

0ef20b3c05d8d17c57806b5e68456020
SHA1

b78d681f3884b6f34dd7759e89ab091084a66537
SHA256

597d6fcc25692a52f7a0aa4300739bff76f289dd6e6087d2ed2d71ba0101a008
SHA512

23e0d915f25ed6f2eabf77cfac373455ae2d102931b4bfe461646c4acbc2f4c327fd1908a8282f7f38938c892930fe03240eff10188296f9a39ac27d85f90097
SSDEEP

6144:2dspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70NqO:M8kxNhOZElO5kkWjhD4Ay

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
800	AWJAO.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\FHJBVM.EXE \"%1\" %*"	AWJAO.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	AWJAO.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3684-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/files/0x00060000000231e3-10.dat	upx
behavioral2/files/0x00080000000231c5-21.dat	upx
behavioral2/files/0x00080000000231c5-22.dat	upx
behavioral2/memory/3684-24-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/800-25-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AXRTZMT.EXE = "C:\\Windows\\AXRTZMT.EXE"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\K:	AWJAO.EXE
File opened (read-only)	\??\L:	AWJAO.EXE
File opened (read-only)	\??\Q:	AWJAO.EXE
File opened (read-only)	\??\R:	AWJAO.EXE
File opened (read-only)	\??\G:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\J:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\M:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\T:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\H:	AWJAO.EXE
File opened (read-only)	\??\H:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\O:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\N:	AWJAO.EXE
File opened (read-only)	\??\T:	AWJAO.EXE
File opened (read-only)	\??\E:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\U:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\N:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\R:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\V:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\J:	AWJAO.EXE
File opened (read-only)	\??\I:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\L:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\Q:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\I:	AWJAO.EXE
File opened (read-only)	\??\M:	AWJAO.EXE
File opened (read-only)	\??\O:	AWJAO.EXE
File opened (read-only)	\??\P:	AWJAO.EXE
File opened (read-only)	\??\S:	AWJAO.EXE
File opened (read-only)	\??\K:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\E:	AWJAO.EXE
File opened (read-only)	\??\P:	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened (read-only)	\??\U:	AWJAO.EXE
File opened (read-only)	\??\V:	AWJAO.EXE
File opened (read-only)	\??\G:	AWJAO.EXE

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\TLOJ.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File created	C:\Program Files\AWJAO.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File created	C:\Program Files\TLOJ.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AXRTZMT.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
File opened for modification	C:\Windows\AXRTZMT.EXE	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\FHJBVM.EXE \"%1\" %*"	AWJAO.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Program Files\\TLOJ.EXE \"%1\""	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Windows\\AXRTZMT.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Program Files\\TLOJ.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	AWJAO.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\TLOJ.EXE %1"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\AXRTZMT.EXE \"%1\""	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Windows\\AXRTZMT.EXE \"%1\" %*"	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
800	AWJAO.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 800	3684	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	86
PID 3684 wrote to memory of 800	3684	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	86
PID 3684 wrote to memory of 800	3684	NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0ef20b3c05d8d17c57806b5e68456020_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files\AWJAO.EXE
  "C:\Program Files\AWJAO.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\AWJAO.EXE

Filesize
482KB

MD5
f6d2db26a9e64ab096bb11b4002718cc

SHA1
ad6b7a5f9a7eede29f8882cfef017489f4a52ae1

SHA256
c0d6e4f5d2135fa2aac94e1f7b02acf31a27e3d276cbd4df4a1339632cb65de9

SHA512
0028ad0c1764f0000696a2974a66833d3ce7d735f8c31ab070058d24fb0c36ddeb11999735618dbaf8c8ba588a8d7668b917de910f3415791c78cfa9764c5eef

Download Submit
C:\Program Files\AWJAO.EXE

Filesize
482KB

MD5
f6d2db26a9e64ab096bb11b4002718cc

SHA1
ad6b7a5f9a7eede29f8882cfef017489f4a52ae1

SHA256
c0d6e4f5d2135fa2aac94e1f7b02acf31a27e3d276cbd4df4a1339632cb65de9

SHA512
0028ad0c1764f0000696a2974a66833d3ce7d735f8c31ab070058d24fb0c36ddeb11999735618dbaf8c8ba588a8d7668b917de910f3415791c78cfa9764c5eef

Download Submit
C:\Program Files\TLOJ.EXE

Filesize
482KB

MD5
fd0b7825403863708b4309d75ec23596

SHA1
d29cbfa2884a980f45c381aaf597c763ab76b5d7

SHA256
620b41bdf28e63a5822fe54bc94e67bf1503015bc37dc9f57fcb24423780a1e7

SHA512
6a12f1db1f631d083d3c36b6dfd869da6b61df59b8be067a2df1f9fdc558f3bad31b18c25b27478ca5d7778578a39daf525366a337fe2e1749ad778daba763a2

Download Submit
\??\c:\filedebug

Filesize
255B

MD5
3c178dc762d01d17ff9fe7d3fd54e6fd

SHA1
8cdea12e188b2d51aca21cf80eb0f7ebac486941

SHA256
b2b9cd450cbe92fe8edee7d4db140a73a38eac650feadfcd4a37e3539f4ed5d1

SHA512
229e16483799ea4d82da534b4c4cebdf145248a7ee89544d7b706330e22c71cd07d52e023e7a319f6f58ab74c348104bb3343945ace25f976a2617f542625c39

Download Submit
memory/800-23-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/800-25-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3684-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3684-1-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/3684-24-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads