c20bcfe301045ee7ea27c4e8735747eedcc95287221d90bcb8d0b3048763d0fd

Analysis

max time kernel
160s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe
Size

29KB
MD5

2c32ed02a038e805546de8edf1fc94c0
SHA1

948b9e7b7b5368e028f95c999ed4d4096371e2f4
SHA256

c20bcfe301045ee7ea27c4e8735747eedcc95287221d90bcb8d0b3048763d0fd
SHA512

f3fe27c22c4c6824132424bee0bc96ef057daa6b80794e99d2b349ae055b83c34c8deb79777a2da0e3b46aa99dc94c174e76b2ea5f753b896a4e400f39f73890
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/zh:AEwVs+0jNDY1qi/q9

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1072	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1608-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0007000000022df7-4.dat	upx
behavioral2/files/0x0007000000022df7-7.dat	upx
behavioral2/memory/1608-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1072-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-50-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000022d0a-60.dat	upx
behavioral2/memory/1072-90-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-122-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-135-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-161-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-193-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-234-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-249-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-280-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1072-288-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1608-313-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe
File created	C:\Windows\services.exe	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe
File opened for modification	C:\Windows\java.exe	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1072	1608	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe	87
PID 1608 wrote to memory of 1072	1608	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe	87
PID 1608 wrote to memory of 1072	1608	NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2c32ed02a038e805546de8edf1fc94c0_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5PSY110O\default[1].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[2].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\default[2].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X8T7NIZL\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2468.tmp

Filesize
29KB

MD5
ac08b655ebb3f6b1566e0956a1e37104

SHA1
509b65b041fa3bfbfe90d8fa6ba5d2a1c06d0181

SHA256
7fa8ec46df606e2b9f2763f3f7cbec2c1bc99238027a32a70bb84d897c1120f2

SHA512
a2db709fb5fd10dfdf2c438c4b6022e751a4eb682573394fd2f528bf4ace7c4f28d00101834a951b31123be84bd1faaf5d8e29a58148c1e03448bb15ed83ee38

Download Submit
C:\Users\Admin\AppData\Local\Temp\vryojvGcGs.log

Filesize
256B

MD5
6c3ae681b75bbcd7203fe11449e26a28

SHA1
345243d63d8085469fd610057fbe8940903387ec

SHA256
0cec28231c2a8da42567fb66991b62846af014a96d8f027e633321213eade9b5

SHA512
6f971639eede85f72f4381920942def9e8c9c1115a686d3f73500a454c04d862a7442b91e05d0ac2ba16073191936944bc5b735af169ab1b0c9762b39e5b7f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
8e1363cc9a1668e56c9bf0208e743ff9

SHA1
589c23f86372e766e3e4a21ac04f7958d138613e

SHA256
77e98c7f6b32c79d03cbd8399f10747b00184029f9d3985f0ba676bb2e68ee69

SHA512
7c8e2002659e3578947935ba4b93817f673e7c9ae80216e1fca01a5075ba28743e3d770191b24dacf02e97c68b602abecf2878cab9cd12cfb61e43bdff8d2e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
f459374bfae2b93b1102383e1a125e8b

SHA1
c46de9c762c786170d555241c0317aa1684d85c4

SHA256
3070c46ae94c40bed7ca663b0e4f752154f8cf8c37e21bdcdcdaf1f597171b79

SHA512
edcaab3096c66f0757c32fc932326a7397477f26c2483c6f37425456c0de51d2cd443528c2135471a151143ac19f3b5eccacff16a6ab016547e1499cb4ee08f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
34d709aefe1fcf61e78f12c3d6d06e07

SHA1
be8d21a7a314e224ea014b1591718ded2c3d1b26

SHA256
64fd608af21aebe9aa4cb5790b53bbfc8cda5cfef5f158973c18154bc84bbe4e

SHA512
6e5440a71151338442b94680d16225e44583e5bcc28bb2418b7e27fc7c39172b1e6c3f55c85e5aeb271b13171b0e4d7050065cf52b761d9732d2503a39c9e8b0

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1072-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-193-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-288-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-90-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-249-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1072-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1608-161-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-234-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-122-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-280-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-50-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1608-313-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads