56c8b866ba44bb22d6ff77881d0173a7b9725303dedcb622d16492425e8ccd10

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
Size

92KB
MD5

fae5b6f5e4bd31a7c9e8848aa7d5ed40
SHA1

2e08601fefb337eb8444a21fca1c2249d02c8e65
SHA256

56c8b866ba44bb22d6ff77881d0173a7b9725303dedcb622d16492425e8ccd10
SHA512

e27a0baaf7ca6936de7d67c86ecaef5cc5d853d7d02a704cc14d460fdf869cdfaccabe5d272341d68f9b7f697384f0a1da10040203aa98f1d2c665f16f704f87
SSDEEP

1536:TxnhvmXm+tSpzy42R46XTa6HLdqny5tzP4oF0QMwOSlc1fheP0:1BmX7trX1Ldqy5Z/F0vhIaYM

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\apt.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXE572.tmp	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaw.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\apt.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXE532.tmp	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\javah.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\mip.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javah.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\javaws.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXE552.tmp	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXE512.tmp	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaws.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXE5F1.tmp	NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fae5b6f5e4bd31a7c9e8848aa7d5ed40.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\RCXE552.tmp

Filesize
43KB

MD5
26634f1a72f7b49bdb8e38f1de570bbc

SHA1
01f55a7a9251c307bae8c39372fbe8bbe8502f3b

SHA256
59f9efb6fdb2b6d82fb746469ba11fc08ad470eb19df011f6d588e1bd687614a

SHA512
a5418ea8e440795597bd7453a6b6e807ae54ce67dcf67d00bec1391aecdeb6f1f8ec33afb87cf5e66ba8756cd2e798f84730f94caa7014d9c2906dcf025bd70f

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zG.exe

Filesize
249KB

MD5
c7733d00580f77d0d2502b6bd19b47ab

SHA1
bfe827bc0eebdabaa7361eae6f2d2a7ef343c060

SHA256
018092325b09789730097d15396e801cd2517ee1b9d8289b5351077a69805056

SHA512
fbd0f41a9d3c87f62481c93ade071ecfee276c9e124053aefead0f9ada4e5c6f9d33c95d8e7dfd3f71ddddb7b160b5ec139d34ac9dc7daafcdcd65c5307a6f30

Download Submit
memory/1072-119-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-120-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-35-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-36-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-116-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-117-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-118-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-33-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-121-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-122-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-123-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-124-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-125-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-126-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-127-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1072-128-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads