bad4a97b10c900e1002c054bea58877eee0a367aa63e2c599abd68b40b03cdd8

Analysis

max time kernel
107s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe
Size

29KB
MD5

143b514464f1377f8ad3a9c44c2b4060
SHA1

82db0af5d91ec3061737560ac2334ecf6354d4ec
SHA256

bad4a97b10c900e1002c054bea58877eee0a367aa63e2c599abd68b40b03cdd8
SHA512

58a991a4e1cea47352dbfda409bd406a28d7728e6994ec0fbed2a4e1e52619358a51e5674c4f4041e9573db0f52f0a9749e57677cdef4d898f63a8009950ccf1
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/50:AEwVs+0jNDY1qi/qe

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
756	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000022e31-6.dat	upx
behavioral2/memory/756-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0008000000022e31-4.dat	upx
behavioral2/memory/2028-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000a000000022e5b-55.dat	upx
behavioral2/memory/2028-68-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2028-118-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-120-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2028-159-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2028-220-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-221-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2028-280-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/756-281-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/756-307-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2028-306-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe
File opened for modification	C:\Windows\java.exe	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe
File created	C:\Windows\java.exe	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 756	2028	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe	87
PID 2028 wrote to memory of 756	2028	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe	87
PID 2028 wrote to memory of 756	2028	NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.143b514464f1377f8ad3a9c44c2b4060_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[1].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[2].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K1QHLR0H\default[1].htm

Filesize
303B

MD5
0a53779b07f9c9c56ef169499851915e

SHA1
281bf81610dae812be159f95a0858f88f9b96637

SHA256
b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1

SHA512
5a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K1QHLR0H\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UDS0USIU\default[2].htm

Filesize
302B

MD5
51b86971925c7d24d895ff89fdebc8f5

SHA1
d037148e50a77f0de8421e0ef81f87f9f73570da

SHA256
3b50a39db6499f5cb2d3b6cec01daa5c33fcf80c0722707c6014e23ed1577280

SHA512
1bc88174ee963971ca43e106828d9e74473cf1aa664f6d4fa43ec9631610ab4c1dc9a0c84f5c89dd2b627eaf64f57dee99eca84b88eb14c36bf7285cb9d7f0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5A2S7N8\default[1].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsh2p.log

Filesize
256B

MD5
d0a7512d7c57f038b7d8e585f2976aca

SHA1
f7d0b3a275398dd50b841f9242156af8368864d4

SHA256
96effc38ea830229f3bd3bc004c840e370bb7a691b29b5540db2cc0df639d2f8

SHA512
633719e4ff00cc0d26836ed218ca51babdb2d4f631fa036033b91643d145b4b6fda8c597eaffd59d66f2f7c8c1756fa24c6d495482bbb67505a8a1808f95d847

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp41B4.tmp

Filesize
29KB

MD5
6bf90083bb951ed2c40b3d8c4628d06a

SHA1
e5b61b6ef8b5cc990ea534f951d011489dda4459

SHA256
ba9d121ffbfc07b0acf0c8ab86bd09f014cf96c3f847bbe7ed2ba075ec97fa89

SHA512
909a7a9678e63b203e8ea80f695ddf3754cecdb6464a4b43615a0a67d3783102a0b5de6a208eb3127a713b1a358fa383c45dc275368e8d10256e03aaec4c9c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
f4e961d4c5eec973ff8f829f7cce4145

SHA1
e8b8485aaf24df76a12930daac5e2fa3f936e4c3

SHA256
aec207a928ca145f0d662fed0176916c106f86a8ba18284ee090908cc1937dd9

SHA512
27ce096468890cd0bbe00b5a00d8658885dce66b84fcaa49d9cdd68e8b7f394f012f345a2a261cd08c4745bf7034b718c70bf1c554388a5324218582425f22f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
074da6bafb1f62896b6c09c28bcfa321

SHA1
5bb286185b6b907f3c318fb7623aec43ba955ee3

SHA256
931f24f2cfce6304ae631ab3ab4b91b4a47a5fc9533252b8325669859fb0434a

SHA512
71c09d1e6480a06f9a0cf5753ba84be623579e30c45d20d1595883ecfcb9fbe3207cffb2d5d27578e908ac525f2cc425e0ec52b99da08917d4f8d8e5362af9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
05c2599a0809085e462ee19c9ce6ab7c

SHA1
9e0e0760f37449d4455f46d0c6539c39e065d78f

SHA256
8fa07c79dffce8407686c508bb52ae3296b4be957b2217560c680b2df719870f

SHA512
f0fc729b92cd48afe0e0e630f4cba658010f391c184bc204e105aa2931143e96b08bfa6003f0d9de5918e541d82a5bd4dfa076d3def5eb0473aca0b1e150c2b4

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/756-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-307-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-221-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-120-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-281-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/756-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2028-159-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-220-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-280-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-118-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-68-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2028-306-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads