3e55f577157d2fc27135789e2d0410c42ba4c4a5fbafdb58b6848ababc02e684

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
Size

33KB
MD5

05b3cdfb789e77d3d4856dfc07d2a830
SHA1

2eb8d440f086d5c8cccae2857137317d3d8aba44
SHA256

3e55f577157d2fc27135789e2d0410c42ba4c4a5fbafdb58b6848ababc02e684
SHA512

9a0ba967d04c799c594eb2dd797c13b4c35813161f0b95abe8c9199a26b1e0c86d55c9986d0b0855917567fbb1b593c1cf32b104912b8960a8e5fab8b0f304e7
SSDEEP

768:r5Gsq/XQGcoGVzUDWbcvZOkglUWJY3ggxfha5:r5GD/XPgQGcvZORS3g+

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00010000000108b2-9.dat	aspack_v212_v242

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\tnameserv.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\jp2launcher.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\rmid.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\ssvagent.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\javacpl.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\pack200.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\orbd.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\klist.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Chess\Chess.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\rmiregistry.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\servertool.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2404	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	28
PID 1888 wrote to memory of 2404	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	28
PID 1888 wrote to memory of 2404	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	28
PID 1888 wrote to memory of 2404	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	28
PID 1888 wrote to memory of 1792	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	29
PID 1888 wrote to memory of 1792	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	29
PID 1888 wrote to memory of 1792	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	29
PID 1888 wrote to memory of 1792	1888	NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\at.exe
  at 1 /delete /yes
  2⤵
  PID:2404
- C:\Windows\SysWOW64\at.exe
  at 10:51:12 PM "C:\Users\Admin\AppData\Local\Temp\NEAS.05b3cdfb789e77d3d4856dfc07d2a830_JC.exe"
  2⤵
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

Filesize
151KB

MD5
e7dc3153b95fc3afeb74ff63943236f5

SHA1
856bd30f5b2185ec9958feed4fc8ef694c6050ab

SHA256
e281d0046b927bebc46ef07f7bd35fb46f5bc17b2f8c00f44bdcfc8677e12c94

SHA512
0265d0a4ee5f541252f0afe08f3e4c5e1eb95a1bffdfe2379032d5ed782eb5d944c830fcc283ec20acac91efa798bf51649d21b449b5899965114c959c1a570f

Download Submit
memory/1888-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-33-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-48-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-77-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-98-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-108-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-115-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download