469057f3f984d308aff5f53265254e9eecea725bf40d367548b3da6db91cb217

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
Size

2.1MB
MD5

4fbfb186d18a77465f278ff7f1d36f70
SHA1

5bc654c911b14adae80d891de20802639f3072ae
SHA256

469057f3f984d308aff5f53265254e9eecea725bf40d367548b3da6db91cb217
SHA512

668c16c18bf2bc382fa956b8f8980834f316913b26329b16e9f6b0e4e68b3fd224c77a18761bc8128f5f80f3992c38d8c4a10879572eadd6dc1ea4826c5bf6a0
SSDEEP

49152:/RQ6PAJc0i0idV1q4GuFEEvvfXKPLPtdc0SSzSgYv7/Xoe:/RDAe0gvXWPztXSzX/

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaws.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaw.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX65C9.tmp	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javaws.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javap.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\mip.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\apt.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javah.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX64CB.tmp	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX6589.tmp	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4fbfb186d18a77465f278ff7f1d36f70_JC.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\RCX6589.tmp

Filesize
37KB

MD5
58a3c5e8e1836015719c0970444c836e

SHA1
06d5ecf6cc0e2339c37b683bdf497a933f384b07

SHA256
e7d35f88ae0e7144567157b10f4789e34c1a048d4fc82afe1d0a50c34d2dae91

SHA512
264101babce9d4bcce488c01a43bdc5f915f7c11764de15556b2016be456bf6e101703f26ee4dfde0b031f05ce8c9acd0db3f3f6604cc7b5826aea584bca4863

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zG.exe

Filesize
2.1MB

MD5
4fbfb186d18a77465f278ff7f1d36f70

SHA1
5bc654c911b14adae80d891de20802639f3072ae

SHA256
469057f3f984d308aff5f53265254e9eecea725bf40d367548b3da6db91cb217

SHA512
668c16c18bf2bc382fa956b8f8980834f316913b26329b16e9f6b0e4e68b3fd224c77a18761bc8128f5f80f3992c38d8c4a10879572eadd6dc1ea4826c5bf6a0

Download Submit
memory/2148-110-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-105-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-106-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-107-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-108-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-109-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-111-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-112-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-113-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-114-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-115-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-116-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-117-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-118-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2148-119-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads