25951250376b48e4ef012d876e1cbdf13dec84ddd7d4051c77e6647586432857

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
Size

76KB
MD5

02d7186b977b4299a1afd2e431446ec0
SHA1

ce2bad5348e408fbae28c38136e5eecb3b4e7dea
SHA256

25951250376b48e4ef012d876e1cbdf13dec84ddd7d4051c77e6647586432857
SHA512

b330713c13b5ef592f27c85fff2dbdb2c3b7f51f8116cdeb862eace1b2c19bde272b3e4097f836b104d166c6102f8ad0a23e0a681662c3f3428b6dd182d7d74c
SSDEEP

1536:Uvexs6pWGq6cjTArxtvRCLB6Px9+3cu9V+gKW:KcpWGqzjTALRCLB6ZAs+VBKW

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Drops file in Drivers directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%SystemRoot%\\system32\\exloroe.exe"	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "ÏµÍ³ÉèÖÃ"	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Loads dropped DLL 2 IoCs

pid	Process
3288	Process not Found
3288	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2752-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000100000000002b-8.dat	upx
behavioral2/memory/2752-87-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Public\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme2\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Media\Desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	F:\autorun.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterVmqQueue.Format.ps1xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\MSFT_WaitForAny.schema.mfl	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\XInputUap.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\EhStorTcgDrv.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\NdisImPlatformMp.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\TtlsCfg.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\percsas3i.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\TSTheme.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\net7500-x64-n650f.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtvdevx64.inf_amd64_7b972df4e09f9463\rtvdevx64.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\machine.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetIPsecRule.cmdletDefinition.cdxml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\msdv.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-IsolatedUserMode-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\acpi.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\MFC40u.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\DialogBlockerProc.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\bth.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sdstor.inf_amd64_0d2a33dd67a36577\sdstor.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\lltdio.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\ntprint4.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psm1	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\AcpiDev.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\html.iec.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\regevent.mfl	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\curl.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\hidserv.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\spfileq.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-DialogBlocking-Package~31bf3856ad364e35~amd64~~10.0.19041.844.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\wbem\de-DE\UserStateWMIProvider.mfl	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\miradisp.inf_amd64_14cd3615d012fdf0\MiraDisp.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\Magnification.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\P2PGraph.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Management.Workplace.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\DispBroker.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\xusb22.sys	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\SensorsServiceDriver.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\PlayToStatusProvider.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WalletProxy.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\de-DE\WindowsPackageCab.Strings.psd1	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\where.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VirtualDevice-Gpup-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VSP-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\hlink.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\SortWindows6Compat.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\mdmcxpv6.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\VSTBS36.SYS	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\Geolocation.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\networkhelper.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\STEXSTOR.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\F12\msdbg2.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\GameInput.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\sendmail.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SysWOW64\desk.cpl	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netevbda.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\sti.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\c_volume.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80_altform-unplated_contrast-white.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\acrobat_pdf.svg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-24.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.Common.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.winmd	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-150.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-100_contrast-white.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-white.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\SlowMotionController.xbf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\logo.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\es-419.pak	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-72_altform-lightunplated.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\msedgeupdateres_gd.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\WideTile.scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Diagram.jpg	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-200_contrast-black.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\wintlim.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\igxim.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32_altform-unplated.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PLA\Rules\en-US\Rules.System.Network.xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\TileButton.xbf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\hololensDiagnostics.html	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Fonts\sseriffg.fon	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..nrollment.appxsetup_31bf3856ad364e35_10.0.19041.1_none_7d08a9dfdeeefe23\AppxManifest.xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.19041.1266_none_d8d95eb2789b7e94\r\eappcfg.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\WindowsInkWorkspace.adml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Compute-System-VirtualMachine-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-VmUiDevices-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-vm.js	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_10.0.19041.1_en-us_6d706fbc31ee8f40\iisui.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-cttune.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_191eb0df2ae4e6bf\cttune.exe.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..-tools-mmc-adsiedit_31bf3856ad364e35_10.0.19041.746_none_911fb46a38a61421\ADSIEdit.lnk	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-internal-capturepicker_31bf3856ad364e35_10.0.19041.746_none_9f5d3567c34d3361\f\Windows.Internal.CapturePicker.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-castlaunch_31bf3856ad364e35_10.0.19041.746_none_feb9545c78481ff5\CastLaunch.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\PolicyDefinitions\it-IT\GroupPolicy.adml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-OneCore-Helium-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hlink.resources_31bf3856ad364e35_10.0.19041.1_it-it_0d97ce99570df18f\hlink.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.19041.867_none_14b972285c05175a\C_1253.NLS	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.Resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars30.scale-200.png	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_817c47d0411338be\mdmcxpv6.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_fsreplication.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_9a47e17b777b2876\c_fsreplication.inf_loc	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-xinput.resources_31bf3856ad364e35_10.0.19041.1_en-us_b83e3b981d5276ba\XInput9_1_0.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dafwsd_31bf3856ad364e35_10.0.19041.1081_none_d3e81d84a960ad49\r\DAFWSD.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fax-common.resources_31bf3856ad364e35_10.0.19041.117_en-us_27c971259566162b\WelcomeFax.tif	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-inetres-adm_31bf3856ad364e35_11.0.19041.1266_none_a70d41d176796951\r\inetres.admx	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-SMB1Client-D-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_3c385645ec509d07\wextract.exe.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..re-server.resources_31bf3856ad364e35_10.0.19041.1_es-es_4185fc13aec29b7f\dps.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\INF\c_ports.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Basic~en-gb~1.0.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_usbvideo.inf_31bf3856ad364e35_10.0.19041.1202_none_27bd1529e8f0be36\usbvideo.sys	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\INF\netnvm64.inf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Net.resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Data.Entity.Design.resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_0bc0c6751faa809f\memtest.efi.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..providers.resources_31bf3856ad364e35_10.0.19041.1_it-it_b39e98d9d2143c2a\ProvProvider.dll.mui	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Web.Routing.resources.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_miradisp.inf_31bf3856ad364e35_10.0.19041.1_none_9855bc0311d2883a\MiraDisp.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..cementmanifests-net_31bf3856ad364e35_10.0.19041.1_none_6d60b01ac2c12eee\DirectAccessServerManagement-Repl.man	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\GlobalMonospace.CompositeFont	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.it.resx	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-inputprocessors_31bf3856ad364e35_10.0.19041.746_none_783ec1d1dc7110ea\EmojiDS.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_10.0.19041.153_none_9539283603c64592\r\GenericProvider.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-defrag-core_31bf3856ad364e35_10.0.19041.84_none_100185bde62a04db\defragres.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_d23715c9ea6f2f2c\r\appxmanifest.xml	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-imageres_31bf3856ad364e35_10.0.19041.1_none_92aeb0b697438cb2\imageres.dll.mun	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\SystemResources\shell32.dll.mun	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_volmgr.inf_31bf3856ad364e35_10.0.19041.928_none_30299b60c292d748\r\volmgr.sys	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Installer\77ea.msi	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.resx	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.19041.867_none_14b972285c05175a\C_855.NLS	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-composable-switcher_31bf3856ad364e35_10.0.19041.1202_none_c6bc9919830beaaa\f\TaskFlowUI.dll	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\r\oobelocalaccount-main.html	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirdpclient.exe	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\SetMDL2.ttf	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.mum	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 884	2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe	88
PID 2752 wrote to memory of 884	2752	NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.02d7186b977b4299a1afd2e431446ec0_JC.exe"
1⤵
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Jilu.txt

Filesize
4KB

MD5
dd78d606cbba4b341a03270a06bb17f7

SHA1
78afc2bf57430cbc445e1b334e2e4976726d0520

SHA256
834b01940688ce162331bbadd10004aa1124a2c94a6c8ce2410c4c917075414a

SHA512
e7d25f8adc631a3c7ed7af75643743023f5bda25c7ce51be63cca4b1036a6bf596e3c8980103153fa6b688a064bd38abcb193112a03743d7b96546285333309d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
1.7MB

MD5
c606bd7c9c733dd27f74157c34e51742

SHA1
aab92689723449fbc3e123fb614dd536a74b74d4

SHA256
606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0

SHA512
5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
bf6f6901b7f70ad8842fc2f3be213aa6

SHA1
e45bded84c4fc25f84004afba058b0097799af8e

SHA256
d9328d2967b697533ec040317dd70e3651c9a44210da1ed978a4b8e5597dc2ee

SHA512
6839ca885820f8ba901147a725618b8fcba46c02a1bfea02c34b0d32c3017a62ecd6bb93c7046d88e77cb730d986dccc1da6360e2aad871321f0e4724ccb6cf0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
3dc3ec21e9edd8c9d2d52c6ce0bb3e5a

SHA1
a0ac3f8a970e1ff5d8bb86d2a7be0926cda8ad0d

SHA256
b2acad5ce3e2060b8f92e1421e253b432c255cb8867de1db6115702afd2f3fc5

SHA512
c714028e16f50b2aa9511701f52b2d9e7b8d0f2bf07dc0e226d2002b09d7b72a64445737f3c0054b5d3d9faa4d043323a10f262fb9cba74bb3a7adde5bd60001

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
55eae5d2fb72223fa3fe71d82745bd9f

SHA1
de9f7907ffb13acc83f17594ab1d34d596144cf8

SHA256
79141e881a5abb763614dac04b029e645cfa4d1f1a3623f1048c657e2fe4a4cf

SHA512
55f4511499f628485aaa79baa528bf3a981a5db7912445394b98540a6fe8789c768eb3dc760ef8e37665ed0d8f345c110657684d11fdef8b4c8d50f4766b2a9f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
0e1dbac67a1c5a71c49d0c5e1fde8b59

SHA1
2e88debe7ebf900a8b3e618d12ebe0bc3eb929a1

SHA256
d0f5a0a25faf3d12565292f5b38848ca53b5397af0b7529d259e36b9d21eef35

SHA512
2bf3c1bd7095dd39c0c8db9d5811a54c4f3ea94e4607d5c5606bfaeffd5cf1df64d1a6b14e10ec4628d53cc94fc0472eb619469faf224cb2deeec42c15deae66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
edf0afdc0128d7f629fed0faf2579a81

SHA1
e5aee733e3dce326f122c2c3c35a7359b1754fcb

SHA256
800ce0a74b1cec0e7f13290432c7de48f90f7efabf1003db8e87ddc5b7cf7a52

SHA512
5ff249e68d50bdacaec6e9d4c0c1c37cbcb9ff29682cd09dd7a53ece2b3e61d9a38f32775d14b5ba1e825a9cf47e8157a7a20532a8df49ed2a121b803a4c8b24

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
bec2c348aae4e370a119304b7089fab5

SHA1
cf4286052402d47d67fa63b22d523427b90fe7fd

SHA256
323889556cff285b78a3e55c7df3d03e4d5fab4c41bcc4f9a2d96e9a62b155ef

SHA512
395829fe62536674f16ba76e3030cfec449aada4d081d7b2cd0697876a8db2474b05bf697cdd49eff250dedc34d9dde4a69daa8c76be6a3f5754f024cfa3342a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
cf26386ce9fc8b90cfff4d9380a8e527

SHA1
71d4c6f5acc0e35dad26dbc0ee8c265e36acf254

SHA256
8d18e110498599912b227282f70656f608755303b8acbaedfc1ed66ca94a3a57

SHA512
4fcef6795d625f07a79e1c344e9430d762981bd0b518ec49a2016a8806243e8f5f84aec6bcba1ccab494f8e39afe8a38d6e39463741649c354f649d461260aa7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
a49a8994e1d3c8440b1ac9edd6cd2b3a

SHA1
0db4ef18a268b4e6714f22dab1d935422e1ad718

SHA256
1cd8827d0fa815c7c3e74a4267edb94b7e2080831c48356395aacbc703aef5bd

SHA512
684275aa2e5ea9dd3e968cf3756efb4e6a3f851b84e5c54e3bbae7e7ddba213850e98b4e14e17b57dd1c9a8ce7d9ffc1672704b564c2bf81cc0ad155c533f8d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
0fbc61632974f6f29b389af69737faeb

SHA1
c6548ce17d48b0301938e3607ccc5ddeb6a29afe

SHA256
ea2e659f94962c0f2a1979d97f40f21a3bb69e16efd4f2e57fac9697f6e0be0f

SHA512
e09574ac51bf44175ef24143a16e80254561edf0b73f813bc8f453ee30ddb06c93e74ace3fdadc6b96f8a115bae4c2efc6cc3ba3bac79e7cf612799da6506770

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
3b807ee26c98b495a919961b5e212926

SHA1
de9def29b45a9194ce09c276f34fdc6dd2377fec

SHA256
dbfe9720eaf3ed06618c3825e235cd685a7e49e321d5ce41b76d32716024dfa6

SHA512
d188399a76b16402a569a94973cd94c6bce9592efcb0ce07178214fab03403b16bd2766e21e0a1aec2d6ce13ddaf35e58848bd9ca40605aeba9591d0900c90f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
49626189b170ef1f616fedbb8e9659fe

SHA1
6df320f02e0d792db7a9270bdf26e1116351bd2d

SHA256
86ad023b154bc56f0479808fdf3d462076c2f721ee896adf45439423ebabc435

SHA512
9c212d2220109b8375a366bf0bc1caa3446a26beab856c496b9699771d4786e5c51a3e1753942529d23545a16008e5e7ef8cf04451892691bc9dd2b9d85f6933

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
b62de344039504b0b7e9ecab12a1ddc6

SHA1
11699ed72e4a0fb9d5eed0bbbf1f7178f232ad67

SHA256
58061f377a32f4f7c17f754045f858ff470cfa4a709e98e67ef073e9de4c7864

SHA512
3f210258f81a22db9132027499bf655bbdb1c2b5d09552901f986a20b7586cf8a09d33d736db4b78a49f8ea2ea5b85ef2e7412d4e8a8ab01f213a1a98f56ae57

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
117e3c281379bb081f92c8e89bc80907

SHA1
be5812f2261db2102209720cc7828bd27fc7e4d4

SHA256
e7cec71c01d3b7c1d0746a0014a948bd1ce69c5329b5c1ef0b984360a82644b2

SHA512
4ae89f89af79dc59341d4a43956e61b45d7a3dfce1584bca6ac99968027689cdf45a13442cd826c06d09598cec43e674d13dd49c3a0100fa375f1acad5c0b2f6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
0810e56f14150a49f329fd814e44681a

SHA1
6274a45877ec782cf2d81c8682593a0318b98313

SHA256
43745e2610184e8a962f1618db51f58bbd82572a8fa01f67bdf520a579f1c079

SHA512
8b06819f3b3124c1a8c7205231eb4bb8628f98a42ef73698954afbc8b7e67cc5180352fe582b1c386cb2991d446e92835db1d6f55935ab8b1b4ddabede2e2121

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
cd84b119ebffaba74773617033cb6674

SHA1
7b0e335b8b678704566e0f216bc62b0e6655acc0

SHA256
466351c7e536669c4f42bd366ac43db91dc47e5b7f95af56507cb3294d0c1419

SHA512
fd9e7525c9b363d487edc5b14b9a68cb28ee5632cbb046726f15868d288bcc776d40e031c3af2fcbadee08cf83208160eeeda18caa1bd49f9fbedd6f30cf9af1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
4KB

MD5
ed4bf7a3d573a2f74174f4b6b2b3ce4e

SHA1
9eb14f7ffef1b9a1efdf67712758a579f7625a3a

SHA256
fce41934a2771525c68c524d90427f7e246ebe25bd407be2ca87b8eb28c81eab

SHA512
57b631db6887288d442eb529bc6c24b692c7d276b56c7952af3ab5e95f54765613e4dda03fd1297b2fb7d2bbd06bc837da76b4f1fa1115c3fdb43539b7bffef0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
9ee37bbd48ff7a1a68456b117b0a303b

SHA1
4561b070fadc2ba68d41f46560bd77ecd196b0a4

SHA256
80f4235cdf0ef650b6b58dbdacaec6e5720eb4679f28c274861660d08c9514f6

SHA512
1bc598aa04668826e93e4c2709fff37192105932c0e62b05fafe913986d675c7f1c12af2f45af4a8be41a74a95b393511e0e56173a6eb1388169f8409240bf18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
bc8c570bc0f2b3a7b840c068657fa6b6

SHA1
74e3b62dc1d8e7eb6e4403ce70e9eaab6af33355

SHA256
cd894ffde7a140b5d032a29ec43694a5d133448104cf79db87c866f7820d955d

SHA512
eeb5dce278690e4a57569b1a8fb3df126930b8106106c0915ef9627bf4f744a1024b56c7b7125df0e00e47dcb99ccad6f4d31713aa293869125ce3529e370b36

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
cb6ccab77622fa57c7fa8c99dd5c8cc5

SHA1
0631987814aeeb4b88974ff10f0311cfe4f87ef6

SHA256
0c220ffa13badfd659c6747258b451f07ad9150304e731eea9bbe6d24739b0d8

SHA512
fa5e40d949235e1b3b2aace3e8c8c79dc6940b0c31aa2004bb352a463a6ed186bc876bc6e6ab0714403649b6235a6a47a2fb7afaec100c429b2eea6b2efcf3b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
b4ecddf369366bfe52e9cba8d0bedc99

SHA1
af4c5407dd2ed37b639e79a6154f567636036ee8

SHA256
78f0a199d86fee526a7135a1cc442c4955d683688b902d38328c1d6b53c1940f

SHA512
57cb8bf7d6a3660cb09b10bf2b790ae789d52d9f8aae08a38ae1d1d9e12ce20fbb8f1e4eaa8fcadac49c289d4ca545ddc89dc09210c48788059fcaf9a27fe5d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
d9881ea1ea38b56c4130d2a28e8b4337

SHA1
31e5db83ddb68d283684adeecd47bb84aadb1a2e

SHA256
b4ba4ba3f832a667ef50e211655396cd0c49f193956a58a8ab0c74e208c63ae1

SHA512
c98fa43c3f026c9fa7a4a52a2693eb7ccf09e355d5a81baef2aee8b0612dc92080f960f7bfa598d5d01933334641012dbada4ce6cd5f1684bdda25b1186b9d86

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx

Filesize
817B

MD5
b68eff3595c120f016ccd89df416f8eb

SHA1
eb735b03325d735ba0f6200543c3458b73547a23

SHA256
05127968f649098c105f24b04c04f8d67169f4de3f653f72ba5b722cbbfce090

SHA512
64ddb97022f4be63a994c1781fb3d98385f611c35ae05cf8013ac42d9381c703fdae48bf117eb44be8c3efd0fd0d88685c07b72c8457d173e78b3c26ea3525f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
e2a262b41c4a32497031cf5848d9a2c9

SHA1
7f6a242757bf718f4db296287e17471fd7cfe227

SHA256
784fa62464b85e13965d74e1f5216628a1b6fcb77aec811401bba6f88294a9d2

SHA512
d17aae2ffa0827de63ee12dece114a90738f53266a3f93e3d9d2cf95d1f23eba04e0067270e1588a71f2ac42def615815408bcbcf8d6de7bd7806c3f58894cab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
9e4eb001ebdb502833796b593dd475bd

SHA1
92b05f9a5887e349bbc478eb57f94234381c3417

SHA256
4e32479ccb6a9567cc9fdcd37e36ea723d7c616d4b1058fb4fecdc17e78bbc12

SHA512
af7ce86d4e393965585e9295a85dd48790eb373650e3c75895c9690329f5bbc469ad242493fddb6fc994ed800d890a80ef2346021b6015a518daaf5c7392c308

Download Submit
C:\autorun.inf

Filesize
91B

MD5
1ecbee74203c68e028f33401bf4bbe36

SHA1
d61cb792dbf96b5a9b4d72367cb1150ca2618279

SHA256
05b04e8a590868f3fb7386de34a72288b90531d5d067bdc40f954a2736706293

SHA512
35620ad6fe8c69154311d71bd2459aa0048d8b98e24b4c5bcd8bc73780ac2b45cf7eb2e8adc0b8dfaeec2f54c0141ebe93a00bfb999ab17ee7d24948a6082960

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
38b1583c88e360e14da9ae4a52673313

SHA1
e94983b6838e40adc1bae8b211b0b09cecef8b91

SHA256
f75ee4248de76201acf0d3201ec796abfa4eaac3a4e2c6f75f1100005ba194d9

SHA512
f4902b7e9109c0e930080648d46793719789ace7683fa1f140c39409489af1f54813a0de0352fe88d971ee503d99cf258ce6a0b60bb7bc32dad161cfb31be8b2

Download Submit
F:\Xiaohao.exe

Filesize
76KB

MD5
02d7186b977b4299a1afd2e431446ec0

SHA1
ce2bad5348e408fbae28c38136e5eecb3b4e7dea

SHA256
25951250376b48e4ef012d876e1cbdf13dec84ddd7d4051c77e6647586432857

SHA512
b330713c13b5ef592f27c85fff2dbdb2c3b7f51f8116cdeb862eace1b2c19bde272b3e4097f836b104d166c6102f8ad0a23e0a681662c3f3428b6dd182d7d74c

Download Submit
memory/2752-87-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2752-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads