b5e6ce7de411737f3f78fec5f2ba3dae09cab9443efc0fd7698eb21c2f3bb60f

Analysis

max time kernel
169s
max time network
190s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Size

29KB
MD5

3b65ebbf713b7a837fbf91d2782f1260
SHA1

ec236898ee2b42b115aed06544c9a008656af982
SHA256

b5e6ce7de411737f3f78fec5f2ba3dae09cab9443efc0fd7698eb21c2f3bb60f
SHA512

606eb709a8ea184287935c6c4fe0aa590b819f0cb5324dedef7bc4fc5300ec76a2f5e549d9c1ed6b05c64d921d111b31392752b9bc3ee3e0ee8cc4cecf387d7f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/yh:AEwVs+0jNDY1qi/qm

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2396	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2276-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x000700000001210a-7.dat	upx
behavioral1/files/0x000700000001210a-9.dat	upx
behavioral1/memory/2396-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2276-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2396-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-51-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2396-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-66.dat	upx
behavioral1/memory/2276-739-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2396-747-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2276-1555-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2396-1556-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2276-1839-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2396-1934-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2276-2467-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2396-2468-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
File created	C:\Windows\java.exe	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
File created	C:\Windows\services.exe	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2396	2276	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe	27
PID 2276 wrote to memory of 2396	2276	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe	27
PID 2276 wrote to memory of 2396	2276	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe	27
PID 2276 wrote to memory of 2396	2276	NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3b65ebbf713b7a837fbf91d2782f1260_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1be63801c81f1a1609f033dae05a86

SHA1
93e4fbc491f33162dcfdf4ba62252c8a2f5f4084

SHA256
75b734e69b54facc79cd1bb0364e6d2bbffa20a5c34adff81ff1326b0d98782b

SHA512
819c2527e2ca19808d0a033618870766c10368521cd7ea759453defa39f2ca316bc2ffa57aaedace3768f83c90dddcd4ce1046223744850a103b207020f51120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77724821023aebb507024b59d4382405

SHA1
77a7956ba9d7c5c9d7845ccdcc900f60b528c89e

SHA256
94a10968496a42fcb607259c7c1ec01f2c5e08591f3170b8eee8b5a6523797f2

SHA512
a4ea4d660889b60c2fcfc200aaaccb297f467bc9563497a5687530555e3a547c7bec3af9635360f26fb1d9eef8ffcb3934b7e246afffe2787d414e9fee5bdaf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e37a6d586c256ff359654cf7ceed9014

SHA1
e9a1cb23518cb2684e4369f87e888d3a09f6cff6

SHA256
f0147f42b4dab36214f6a8908d039d71c6342f6a2519e2813ab31a297439388a

SHA512
f3c1bb8730c2ee9bf4132fdc32c5789016ad1ef8e63c3d97b35137339e80a0e45bc370380849b00d3a8b5e52e8bbbcb56a3a8c30d433148a35a03ec332d61fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ba9c2fbb453b07e0591f5b515ad144

SHA1
14a95a4cbcc9327706a52a11e3d12129aed2c20f

SHA256
73ef495fd6adac05a71c8a0caa205a9f44497d1819bb19ed09beb74c47a2175b

SHA512
91013fa1a60f7b80a16f4ccb9338408ef2eaa245c343b987a0c0590f78e627ff242d881863c6dd8fde37dcbb34194344fb4bef8955f57e451a6614e12f16e325

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48dd6db9c3a92e161ecfa2c799482a50

SHA1
621c17cf2f0a052accc383a818fd068de8214823

SHA256
76ec38ba87a0e70c21769457d627f1583a5450e6dd66752256138f7b74acff0a

SHA512
c3708aaab1cfa038cb8641ed1a5c05f0e7dbde2f7bec10a0e5306bbf1b3b5b539db1b9b635f7a30164ecc34d6042c49f8ff74935b1a9335d007cbf2a7e158f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df398b740b80ed5ae03dec3fb9582fd7

SHA1
c9710b3bdca23276ef1ab57807fb3f3a91a08e16

SHA256
a042a1ba526e3125cf31b4caf320171afc08c76e5e6cd2949caf1d32dec942eb

SHA512
249deb2fe86e1af3c81d5b756668af1a856973b8e70ca6a26bf04a37e8c7988e8024b4fbc87d5f24d55702d7f8efab6d1382b54898c4c45847a3e9e929507b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287842d61db804eba707ca7837555a60

SHA1
3fd86343fe58aea4b479da7f7bfac8fa98cd295f

SHA256
6df85d0fe1a028320ac188b6a7d20e30ec40ae9912edaa3953bfad333f481013

SHA512
3089dbec153cd102c12724de3ea5cd1981d784bf1b86e81a1b6b735d0323377c8e5efa75625b05fc321f23dedf12616dc01f67154b960ea88684e1cb2c9ff0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af333b42e9d8c44eca4bda9cc185ccd5

SHA1
a7bc0564ac19a0e065e94a7ea0b22fe17404dedc

SHA256
457bfe4f656d657963f7c6b8e234e7674e793cbd25d38452c46d7ca1dc601801

SHA512
2711448bc27f0c3d6badcd0d44aa84a13f6321e010f1c6143d333ea0e6e527c584fd8c9efc5138eade85c213b417cd118469cef0b60cf80a43e588fb603e9007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503f443d2dcef66041030edd8096d5ab

SHA1
83ab9cfad3a80cbbff4b26004c3df2a18c2a2de7

SHA256
11aa48093bfb11ddc81e81b6e0349905903a25890001b1d494e0d9c7d9d62651

SHA512
6cbd316f75f1b9d55a3bfc07681884f61bbb7fc93446a0cdb4833766767d2bcc2c7a5ea8b6983e33c005184a3a74a892375f2d458752e168b8906f433665aa0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
234910a1e1698f3036b8120bedc34b34

SHA1
508cf5adc2cd2bf74f1b7d7f8adaf37101b4eec8

SHA256
d16fd653c1821747d2d002372d1c8f77dc6187da606fd8261635a6a01e33ef0f

SHA512
29b562f2b14b126998dfd62f954def1941a1607719103b4e9031ac0a3ee692b5288d9ae72e80c24e237fcf3320b5269d18ee5d467e54417a42b361c49e7d3ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0ef223b841934644d083f9e63d35d5b

SHA1
ca8887bd01e941d4c4f8ab9d666dfd18ea36a95a

SHA256
a1eb3de1b1237f4bbedd447d861c9237789dba87e4e45ba8126c1406a773b72f

SHA512
c0784f7580326edf36d576fdc0f6d42d63f61e9aba0073971a870cafec3c4a9b573f0adfd8fb1895754a103dea2d30dad49c30113e621419230040ff208c2608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85e4869596cd6dd5171d376bce91d3b

SHA1
ece42ecee6c55c1ae327fdaee61afb8cfff78a7a

SHA256
9f1d4399d0761ee7f84516528beedcdb7f3b2978ac94f54031a125b877b60245

SHA512
14e1008e51c15f88dff0d19032bde5a5169c21610c0152aaf741efcbc7393d5fcfeb02e55879885e4caefadc5bb4a2afdf7bca95c4eadc084544f90db250cceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66f08fa20ab706077098d7c4dc12731e

SHA1
a0c969d4c354f3bcdc6b9e95b1eb5ad746ff1e4b

SHA256
7e7f722c7ea9c61e27769c9eb84fbe232135284446fca5b821d85bc8b6a2675d

SHA512
b907b96e5355ab25c09e3fb8e14ccb226e943903f628272cd9740129631ec3aaf62474a4f939c08793f7886f922420dcc711a104522564d1315707bba56be506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
756bbf44b014d2e5d839e6292c4e44f9

SHA1
46b64db75dfd44143a117260627ab69799a9b699

SHA256
dca9928e7555eb96ef621991e37754ef3a52ffefbbae91d88390634478602891

SHA512
3520dffe516a9631ba6aaab34bd0ff6c469e7794fbeaf2f574f08b794ee478eef243df65b15df20ddabb7e75bec6390d777828f6338f4a981a3160732040f53e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fed7c431419a375bd50690641fde63d

SHA1
3c878c904e933dc264d68e39fb3c657d5ba37865

SHA256
307f2714f2cc320c25d5920487d0d79bf94f5f4897abc58a5109b822b204e1ac

SHA512
bf25e2a05ecd928c2e82687645965a3348ed57e81931ad196b60206e4d732598dbdcd14e89a0a54b94baa8a1ab7603b4312dbdbfa08461d2ac04e68316f594c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b0e646331dfa99a74c6a8383ecbce9

SHA1
52e341dd93e80c45c39f89c5a2e5ae5f20569b77

SHA256
c9d58b0f367a4a9379bd1acfcc48224657a519f31a0601acae12452bd5ababf7

SHA512
4f97c839611e8df517495171ecbc4689eda861317ee2ff75c3553bb9b7b4e52741d778262511b71aadfb00d7084878e71a23674732985c67c8d3a61143214dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810578b94e076882f3899ddc84599fa2

SHA1
6d61d0d4d46ef1dd6fd820cd0674123515bc12a7

SHA256
62419529a6877603e4a4685dfdf3a60750930238bc5ae6546e3b24adad502012

SHA512
304c8702a2c9c573c5cfa22f2e20ca3d7aeec41a1aa9d6696ae17522930977ad7a5a8ccfb1a9339f2e1dc0c155022556caf4a6759e1083ea8ebc98eebe47666e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7edf6f8c8f80516f72fa1053f21fbe1

SHA1
50b51dbab6816701d5076d946c658910e70434d0

SHA256
227acacd4639ee4e7a05758ef9a6ca2d0ef7fc729f6ff0d9597be52f962e79d1

SHA512
55b6f716d9864458cf5ed2a4b1b782c8eb2032a4f4826a646cb59e20bae2edce41c88c0bd01f17d02d16247c354775f151a6706e6792113138c7b8c0e6fc0173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
074ee0ae6992e8b62a5fad8eb6b956c0

SHA1
46ba16b6a51a163087e1ec5b9bd9a317cdc161d8

SHA256
f38a68d0468b2f0447a147c04bcbdb22f36819ef6b5f4dda26a18dfb5f3e0b34

SHA512
937b4d76f948587ed477e701babc49ce8ac7d9f16a077558073b77c5ed9ed0ff66599830c72b44f776be74934024f1849d202998f094f1f6dbd3a510b4da7c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H57AUUE9\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYJJYCDH\default[1].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYJJYCDH\default[6].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q3NPL6GJ\default[2].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q3NPL6GJ\default[4].htm

Filesize
302B

MD5
51b86971925c7d24d895ff89fdebc8f5

SHA1
d037148e50a77f0de8421e0ef81f87f9f73570da

SHA256
3b50a39db6499f5cb2d3b6cec01daa5c33fcf80c0722707c6014e23ed1577280

SHA512
1bc88174ee963971ca43e106828d9e74473cf1aa664f6d4fa43ec9631610ab4c1dc9a0c84f5c89dd2b627eaf64f57dee99eca84b88eb14c36bf7285cb9d7f0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q3NPL6GJ\default[6].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7112.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar71B1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\eQgCblzda.log

Filesize
256B

MD5
948d3b5c0a4ce5a17d3334b8b097ef55

SHA1
24d572f1c82e6485a4504b3f5e0bc10c22090979

SHA256
62bcb88f2cfd33f5ab463eb9732d1bea39acdf2da1b09c2fe0bb13859e2eed2a

SHA512
b0224c5b6907fb3a8578d463f5bd092d63595b4b1d0f093bb3683f57a644cf77b63248de853ad85e878dc4abca10b3ee0d9d4bbf7051ec2ea10ca15ddd6043f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6AB7.tmp

Filesize
29KB

MD5
783b34afafd7c579e6f39eecb7ba6a60

SHA1
866989045bd35b5764c1027adcd6896d3cbf68a2

SHA256
eda95db58048040a21903be0e55316101b3983676995e0f6fb765bc706ce1375

SHA512
503c7aea808255e34ab660149349b0c4b30360bc0377211cd36e9e4082aa4e8d7562d92d3264c8da8f666bf1d964e9d92cafbc1bb7bbe3126b4a89d150b1cab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
28c740c5bd639a5774e4207438f2dfeb

SHA1
22c2659f1442009be62a5dc1b4c3f617e93b3a5f

SHA256
2d17785b88ed2b6132bcb1aa566fa6b25f19613a6a015266ccd215f58f5c419f

SHA512
b54f691ee8d7c8b941da1795f71e71f6c2464a612780a26bc42ba09a5575e933b487bdcb2fb8676bab5d71c8c7c2fd250af207b46bb92073f67f82fccdcc543d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
33c1a83bb79221425e02ce1704560c92

SHA1
0ef41d91f7c92ed6ce75a7f2e564579fd75de2c6

SHA256
97f91b7fc0e679eb92b3eec31620020a021e342be35b592161af585abd4a64e4

SHA512
5cdc4a83f4a4efeded27b57babb296ce0b5b244c108082a772fe53850ee8b8f64b170e5a05bb1fa76ad0b1634db31de6bf9c15af67f9435efa7e9759a7aa1fe9

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2276-1555-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2276-17-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2276-739-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2276-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2276-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2276-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2276-1839-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2276-2467-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2396-747-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-2468-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-1934-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-51-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-1556-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads