a1f7c8c4f7c4b94caa7a42cc14906ed9e84611c7e711ffae2537af0a54a1f401

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.08045718e37a128e1330c126be017980_JC.exe
Size

227KB
MD5

08045718e37a128e1330c126be017980
SHA1

a9c59465288aba377e0946f64f5b453899941a6d
SHA256

a1f7c8c4f7c4b94caa7a42cc14906ed9e84611c7e711ffae2537af0a54a1f401
SHA512

74596834b625b344b46f10e81aef44cfd24ac9f5f089fa1310ebdcd80797d4e23a1beb738e5dbf92ae09b0f54b6c3f16fde88e365e6e09b037b3835658ef3303
SSDEEP

6144:1qHGoq/TMEq2Brw1jF+WYRI1X/SP/7V+tjNR6GS2DW16:14dNEbajYWYC1X/S37VajrSB6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1864	NEAS.08045718e37a128e1330c126be017980_JCmgr.exe

Loads dropped DLL 2 IoCs

pid	Process
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	NEAS.08045718e37a128e1330c126be017980_JC.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe
536	NEAS.08045718e37a128e1330c126be017980_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	NEAS.08045718e37a128e1330c126be017980_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1864	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	28
PID 536 wrote to memory of 1864	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	28
PID 536 wrote to memory of 1864	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	28
PID 536 wrote to memory of 1864	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	28
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 372	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	24
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 388	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	23
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 424	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	22
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 468	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	21
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 484	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	20
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 492	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	19
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 596	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	18
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 672	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	17
PID 536 wrote to memory of 744	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	16
PID 536 wrote to memory of 744	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	16
PID 536 wrote to memory of 744	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	16
PID 536 wrote to memory of 744	536	NEAS.08045718e37a128e1330c126be017980_JC.exe	16

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2052

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1792

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JC.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe
    C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe
    3⤵
    - Executes dropped EXE
    PID:1864

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1248

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1032

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:328
- C:\Windows\system32\wininit.exe
  wininit.exe
  2⤵
  PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.08045718e37a128e1330c126be017980_JCmgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
memory/536-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/536-10-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1864-9-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/1864-11-0x0000000077640000-0x0000000077641000-memory.dmp

Filesize
4KB

Download