d1f5f04b883d54d10209a18bed911f0f931498a109c2cd7d6947f7383d3fc75c

Analysis

max time kernel
158s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.d653768d8277397a993493e9aa85d070_JC.exe
Size

1.0MB
MD5

d653768d8277397a993493e9aa85d070
SHA1

1962f7d02ed3003a2a7a486d5b51e0b6eb972ae6
SHA256

d1f5f04b883d54d10209a18bed911f0f931498a109c2cd7d6947f7383d3fc75c
SHA512

dd17cdd097ce3611f46d277d0846e72ec9de9390f70e853ee91959ea4ee3187ebb4834f34ae774e832d4d240959a0dde612150a8585dd912ac86519cbb6bb1fe
SSDEEP

24576:S1b348X6Px7H3FKfPbKJO5ce2jOjTZdTi6Nw+7fp8ClohpPL:SHUBHVKYO5c0jFN/p8CloH

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	NEAS.d653768d8277397a993493e9aa85d070_JC.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\LICLUA.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\mip.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSE.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXFD81.tmp	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXFDD0.tmp	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXFDF0.tmp	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSE.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	NEAS.d653768d8277397a993493e9aa85d070_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.d653768d8277397a993493e9aa85d070_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d653768d8277397a993493e9aa85d070_JC.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\jarsigner.exe

Filesize
63KB

MD5
e9b0b0331a108deb8b745fc74938746c

SHA1
978c07b591abfaa789c3b685c0cde3ee7494705a

SHA256
a37c4929add8adef914e7816869a468ca1d66b78699e4d5638d543c1983e8155

SHA512
334325c624f095547cf3f4eaec8528ff16253532d4cbd9f8d48fc8fbc06223291632e04f81fabf3afb75278d15ae821a24b6e873a19222117325df9e711b1c2d

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
1.0MB

MD5
d653768d8277397a993493e9aa85d070

SHA1
1962f7d02ed3003a2a7a486d5b51e0b6eb972ae6

SHA256
d1f5f04b883d54d10209a18bed911f0f931498a109c2cd7d6947f7383d3fc75c

SHA512
dd17cdd097ce3611f46d277d0846e72ec9de9390f70e853ee91959ea4ee3187ebb4834f34ae774e832d4d240959a0dde612150a8585dd912ac86519cbb6bb1fe

Download Submit
memory/4164-27-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-24-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-26-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-22-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-29-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-32-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-33-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-34-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4164-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads