607dd6a6ff3617799948982d59329d61c9065f2b498f8565466bed629571c7e6

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe
Size

29KB
MD5

dbbe662053f5f58f0d3ad364a1b5e592
SHA1

5cb7bd68898ebe7fbafaebf855c7bc17ca2d640b
SHA256

607dd6a6ff3617799948982d59329d61c9065f2b498f8565466bed629571c7e6
SHA512

1ae612df93458b56a884e46caecc15a12be244ff1fd1b28c74a7fb2029b2a7d7c027989b5dd6bb3f6a3ca85c0f64859a21519d23a300452bbb7b531f600070f4
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5J:AEwVs+0jNDY1qi/qT

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1464	services.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4820-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000022dc9-4.dat	upx
behavioral2/files/0x0008000000022dc9-7.dat	upx
behavioral2/memory/1464-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1464-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1464-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1464-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000b000000022e0b-38.dat	upx
behavioral2/memory/4820-103-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-150-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-199-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-200-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-241-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-249-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-283-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-287-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-347-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-348-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-386-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-387-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-421-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-422-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-461-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-462-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4820-506-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1464-507-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe
File created	C:\Windows\services.exe	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe
File opened for modification	C:\Windows\java.exe	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1464	4820	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe	86
PID 4820 wrote to memory of 1464	4820	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe	86
PID 4820 wrote to memory of 1464	4820	NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dbbe662053f5f58f0d3ad364a1b5e592_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5PSY110O\default[6].htm

Filesize
302B

MD5
51b86971925c7d24d895ff89fdebc8f5

SHA1
d037148e50a77f0de8421e0ef81f87f9f73570da

SHA256
3b50a39db6499f5cb2d3b6cec01daa5c33fcf80c0722707c6014e23ed1577280

SHA512
1bc88174ee963971ca43e106828d9e74473cf1aa664f6d4fa43ec9631610ab4c1dc9a0c84f5c89dd2b627eaf64f57dee99eca84b88eb14c36bf7285cb9d7f0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\defaultPV97REHB.htm

Filesize
308B

MD5
5243568476eb2052b2f3b67dc9053e86

SHA1
b126aa6506772f9024b76580bdf28b45e3a7f051

SHA256
2d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80

SHA512
3c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\defaultUG8KJGEL.htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[1].htm

Filesize
303B

MD5
6a62ed00d5950a7aa3df6d446d0beb92

SHA1
608da2a7b63e92b731a7beb2d990405d7a6e9611

SHA256
7aaaf31ea9c2999c775008a4b769336c91d87dc8f6dc0a1015bb45c61bc39fdb

SHA512
10a77d30bd2a5a930233e79830ac6e0a695bcfacb4e33fe9a67a7dc4b4c0ffaf3ca6ce458bf2a6714b9c590997ff816f207bee87536516a2c8e711c3c161773d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[2].htm

Filesize
304B

MD5
084f55ccad6fddfe1704851a5074a194

SHA1
844821de6a0f3c2410341af6b3979f6b59f16a3a

SHA256
b10034ade693ec98852ac56ed2b784c546aeb3f11593a7ece687b17c283cb4cf

SHA512
776a722ff79b1665f904be9972229f03b67c0a54c9ebb4b639d959e2c87398a3eb5930ebd7c2a03b14ccdbba380ae26ae1ffdbd1f65f8a900fddb4fde467aa31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[4].htm

Filesize
303B

MD5
1c025780eab665977ddb7ab89f9b0935

SHA1
d41cec973d380c562f213152010636345b52c600

SHA256
88511d8e593a82040a165137413b915c0e3c12beb747aabe5b934e8183791388

SHA512
6debf713f253fe72c2f4720d0884edff5ec3a55505acf88f39b67988e299c2bfa4527db0327e0778102a1ded2c368b019587675aef96ef17ed46d9040eba81cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[6].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[7].htm

Filesize
305B

MD5
f84538b33a071d01320a46b057aef921

SHA1
e7b43145855c43f8c5d43a9b39e707885c17294e

SHA256
e5a764c9c517f97e07ee2c8e1296e5f68ef436ea513eefb639fc40dffac6e1fc

SHA512
eff4fdc3ad9ba8f40b99b3e4f856546b5f2b17d0e715f4529a0c7f9e3150964a2b1625c0f734b643ff4496cfd9d256aa096c7e2c4e1911e6262dc9fd869dca5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A37RD0G\default[9].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\defaultXRMEW9CH.htm

Filesize
312B

MD5
5431b34b55fc2e8dfe8e2e977e26e6b5

SHA1
87cf8feeb854e523871271b6f5634576de3e7c40

SHA256
3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

SHA512
6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\default[3].htm

Filesize
304B

MD5
8251fff4df202c8d6dd6aaf34f4838ea

SHA1
fa88f08dfdeaff6b86873d447fd26cb7d83a694d

SHA256
a17db628f6bdbf4cdc6fe029542404867306406510dbbdb57a047a75ac294962

SHA512
e9c0fe2a920377777bdda16a8744cf80d15e1d1b3c94b704f8a4c4cf54d2529ede4aea8a2d6d38f4e3c4d02f602edfed659db6613ac7c374e5214a201f16a3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\default[4].htm

Filesize
304B

MD5
3483bf8f41c9a3b9c4acd2c9be5d8d00

SHA1
fe960cf9b9744217b295ed86f66e80c58c4d6052

SHA256
9b402b64c9cddf2ce4c139df23fd6354b51bb218706076d0b6ed1c128df25535

SHA512
1df7f496dcd70238c3982e595964b552548a7100f3b238a65476cc57fb10e3e1d82c19ffc3f4d61ead29657623665126f3e09561bc0feb39f3aa189f603757db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\default[5].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\default[6].htm

Filesize
303B

MD5
07f97a71ff43e619d7c838c2a91cf46b

SHA1
e02a24b2d15bef84bd929fe609513bcc5ec0c3ed

SHA256
f6b0d91f553cd193ff466a4c2453c24479862f34969730f6d1c77da8d8a7d628

SHA512
c0dbdffaf50b382c7ede6b6945f26cc8ad1b0bbffb36ee886172287dd0a65c921a414e1beb1dd7aadc90e20a7fe36a5474508035cf40df6ce0d55235e344539c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHMDQFFV\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X8T7NIZL\default[1].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X8T7NIZL\default[2].htm

Filesize
303B

MD5
0a53779b07f9c9c56ef169499851915e

SHA1
281bf81610dae812be159f95a0858f88f9b96637

SHA256
b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1

SHA512
5a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp277A.tmp

Filesize
29KB

MD5
876e5759ad7cbff7933b79669a9604bd

SHA1
107ff72b522d787994010a72718ed445f27871cb

SHA256
675247804a3c6608f4bfb113a97dc1f345e3c159823241cff1c496cde41f1bd7

SHA512
556ae9261334a0cf75798dc6baccb74526afcea8a908c42d6249e63f85ebbbf186a431629e4517b898ad00e14f30bb120cecff801ed3c2141f300dcd6d0405e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\vryojvGcGs.log

Filesize
256B

MD5
526393d826a17c8867a36e2ab7895df7

SHA1
8c7014c2114cb60a563d68fb52123d9b3175d4b4

SHA256
13974f73ae685da2aa43244b84c125f1111a95a549130528b732f2404c69f7e8

SHA512
24a6ac963d4813de268222ac3d800ea3a73d53b8309bcfeeb1477eee4269cd4367913160c92bd69fffe9a10fb8458c7f77c3b61f6fc76899f49a4b70c6382c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
18cc8d5daa4b2d24673b03551bddcf9a

SHA1
656232c8a8c3c4d4141841a94ad5b13b4d9f4484

SHA256
3adecf42e3bc7bc6ff60d13f2fb1f198cf52135bf8fcbd2ea0d230a4b8b353d2

SHA512
61b46e64567decb43b35860ba936f2f0a8e5d7499dd5310ffa8f87ecaf383ef29e434cb106f47fa4a6ea5607f983aae2fd9e1e5807465aa803c1057d2d96ab0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
8044e0938bc853dca00e64699485a320

SHA1
50d18e1be6f1df55a7d393efd8c3baaa28b57ad3

SHA256
6a539ab80ace9536390964ef878060055b00ae5f62e9e9e7d1d7152c4140e80d

SHA512
7636bfced1720d7555a49c16915be7f5f5bc7b446e078aa330b94dee129c366505276b11a9f7d69a8f00b34a2849f8381a479c9b3875ac725b8c0fbf26037df8

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1464-462-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-249-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-507-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-200-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-287-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-348-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-422-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-387-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1464-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4820-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-421-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-386-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-347-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-461-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-283-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-241-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-506-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-150-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-199-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4820-103-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads