11407d0705fe4d79c41026fb609db56abe6b852712275703d190f0c43734aaf6

Analysis

max time kernel
171s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Size

320KB
MD5

00c8cae5033b7b3b86c511de8e679e10
SHA1

2e2bf763d642662e127f9c92f71670b1d14b4884
SHA256

11407d0705fe4d79c41026fb609db56abe6b852712275703d190f0c43734aaf6
SHA512

f5921abaae443fc0e8734ad99d4bb2229de7e6d575bbab167384f91ad3687449cd70aa98abf7fb50259cd25470449401fa0cfbe83a849359d2705fcadc4a81a8
SSDEEP

6144:WXb5qH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:8542EB0NxDIBuOFe7/uT

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ConvertToRestore.mhtml	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\DisconnectEdit.xhtml	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7056A886-8943-2B39-9CA8-B5056BB4F8F3}	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7056A886-8943-2B39-9CA8-B5056BB4F8F3}\LocalServer32	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7056A886-8943-2B39-9CA8-B5056BB4F8F3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "brevshnvshknjbbj"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7056A886-8943-2B39-9CA8-B5056BB4F8F3}\ = "kscnsllweevsrlzw"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "xjtjcjhjtjsternt"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "wwtsjlzwrebtxqlt"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.00c8cae5033b7b3b86c511de8e679e10_JC.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5032-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5032-1-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-2-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-3-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-6-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-8-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-9-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-10-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-11-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-12-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-13-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-14-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-15-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-16-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-17-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-18-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-19-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-20-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-21-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-22-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-23-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-24-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-25-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-26-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-27-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-28-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-29-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-30-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-31-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-32-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-33-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-34-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-35-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-36-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-37-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-38-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-39-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-40-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-41-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-42-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-43-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-44-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-45-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-46-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-47-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-48-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-49-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-50-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-51-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-52-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-53-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-54-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-55-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-56-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-57-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-58-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-59-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-60-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-61-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-62-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-63-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-64-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-65-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-585-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/5032-3666-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads