1ac1779dde2d8758ebc39a33924a9793deed23776b8362bbb4105217c0350244

Analysis

max time kernel
173s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe
Size

234KB
MD5

1a29fab2f570c8e8d5b68a7dde2a2c50
SHA1

dce2498a6927035821e931f6844a6eff8b632dca
SHA256

1ac1779dde2d8758ebc39a33924a9793deed23776b8362bbb4105217c0350244
SHA512

d21dd985a50b7745213a33914f2e211ebb1748793dd1a5861d7bf59f35c7314201c3eaac6180530890465fc92ee5ec73e932cc02b19a2e6a9625f0e3b362ea8b
SSDEEP

3072:n19h8n2k+45CB3u07TIQIpmeCB3KxA1z+gYitApnirdt435OgkrePTt:Dc35F48cei+TKiirdt47T

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4372	LZ98MR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5068	WINWORD.EXE
5068	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4372	4872	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe	92
PID 4872 wrote to memory of 4372	4872	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe	92
PID 4872 wrote to memory of 4372	4872	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe	92
PID 4872 wrote to memory of 5068	4872	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe	93
PID 4872 wrote to memory of 5068	4872	NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe
  "C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe" -launcher
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe--.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe--.doc

Filesize
86KB

MD5
42bb84cd743a039f3ccb077451d76cde

SHA1
c66ce85d73cb833806cfad0f418fb5e96a394ff2

SHA256
41f47e67d7ac6fed3c52a421b4b99436fa867f2b88567aeac88b8781bcff2c93

SHA512
f156f9e8db777a916bd77879bb670fa5f5c67b2c97261130173165e089467d779c7d980fab29fd8d79b5c5b11287cafe3ce8f8294832baf4dcb7230710211519

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe--.doc

Filesize
86KB

MD5
42bb84cd743a039f3ccb077451d76cde

SHA1
c66ce85d73cb833806cfad0f418fb5e96a394ff2

SHA256
41f47e67d7ac6fed3c52a421b4b99436fa867f2b88567aeac88b8781bcff2c93

SHA512
f156f9e8db777a916bd77879bb670fa5f5c67b2c97261130173165e089467d779c7d980fab29fd8d79b5c5b11287cafe3ce8f8294832baf4dcb7230710211519

Download Submit
C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe

Filesize
148KB

MD5
baf188290c6961f72c5d4eb07cd8b2ad

SHA1
15896679b4e7b4f1e02973a7fd3eadc399935d27

SHA256
3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

SHA512
d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

Download Submit
C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe

Filesize
148KB

MD5
baf188290c6961f72c5d4eb07cd8b2ad

SHA1
15896679b4e7b4f1e02973a7fd3eadc399935d27

SHA256
3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

SHA512
d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

Download Submit
C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe

Filesize
148KB

MD5
baf188290c6961f72c5d4eb07cd8b2ad

SHA1
15896679b4e7b4f1e02973a7fd3eadc399935d27

SHA256
3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

SHA512
d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

Download Submit
C:\Users\Admin\AppData\Roaming\GEK8FC\LZ98MR.exe.lnk

Filesize
875B

MD5
ddf79eb83131d15392283c4a2bfc6e06

SHA1
620fc183fdfdf0011fdf78f350657147bea0e789

SHA256
8c28beb76737e2dfe3c8939480944f47ed620c33a26604881017e3f3c8dd7d6b

SHA512
42e2cb4547f1f41de27958571e13f38579962ce5890aa0999e3f554fb09d401c01447879307533a8d06f372881133464e695694943019d0c5877b6e8358dea07

Download Submit
memory/4372-32-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4872-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4872-89-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5068-68-0x00007FFAC9870000-0x00007FFAC9880000-memory.dmp

Filesize
64KB

Download
memory/5068-73-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-55-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-60-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-58-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-57-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-61-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-62-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-63-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-64-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-65-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-67-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-66-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-54-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-69-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-70-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-71-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-56-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-72-0x00007FFAC9870000-0x00007FFAC9880000-memory.dmp

Filesize
64KB

Download
memory/5068-74-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-76-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-75-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-53-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-81-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-82-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-84-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-85-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-52-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-114-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-116-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-115-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-118-0x00007FFACBF10000-0x00007FFACBF20000-memory.dmp

Filesize
64KB

Download
memory/5068-117-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-119-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download
memory/5068-120-0x00007FFB0BE90000-0x00007FFB0C085000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads