df6b94cffee8b98182948733297b67e056b426088d3538672d44e473a4fcb139

Analysis

max time kernel
158s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
Size

69KB
MD5

94a5536a6f5c294ab403c6fbbdc43b60
SHA1

a095c6fc503a47b30152b67b8b996118d29e7d48
SHA256

df6b94cffee8b98182948733297b67e056b426088d3538672d44e473a4fcb139
SHA512

89da5c9e42ce9a92870ff851501231a06244d1843fd57e20c6be842ee59e553216a907b9aa2ccebeb710a19f02812a554772bc93bb0d7b3a22ad8950fc5459b4
SSDEEP

1536:IaiqH1s+kCtrA2UMT0mTFibDKa1Xohf6ntQc:p1B31bdBob2QXoAtQc

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX4AE5.tmp	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\LICLUA.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSE.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSE.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\mip.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\LICLUA.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.94a5536a6f5c294ab403c6fbbdc43b60.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7z.exe

Filesize
458KB

MD5
4b2db0f2e6b4168e89b879599e27bcd0

SHA1
5681b617c6383dad8309aace0aa145834e394466

SHA256
efe34624564c19f55426bd4ff8b16b706bf7ebaca12ffb3f9ed2cf427fbdc065

SHA512
5bca858208478fc65d54d15c2e9ef35fb114931af56ee53dc3700c78b321bef45c46ec15f17e9864e79410314a1eb56712a536b2906e6a8bd437fcb42efe6c1f

Download Submit
memory/4912-29-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-51-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-22-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-26-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-27-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-33-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-50-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4912-100-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads