Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe
Resource
win7-20231020-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe
-
Size
328KB
-
MD5
068b83f680d3ab641976172c38e4b2e0
-
SHA1
c2b38e59a84c493ab06ce0cc4cd2a769fc67ba6d
-
SHA256
895cc5010ad35ce741ca0b0c8aa231bb230e8b225e9a0a2119ec79175237f0cc
-
SHA512
4336d6df1665476ec06643282721df0b7770a1008bb0dcfe71e8b9c0dd550d59890d1489e4af4a3f6fa48301858f9359d9927433fb9161f99caf77ae9ebe37a1
-
SSDEEP
6144:syWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:sCemx0vN3HKGi6sYjJLUGGtedud5tr7
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\104db929.sys NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Possible privilege escalation attempt 4 IoCs
pid Process 2580 icacls.exe 2520 takeown.exe 3040 icacls.exe 2448 takeown.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\104db929\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\104db929.sys" NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Deletes itself 1 IoCs
pid Process 1988 cmd.exe -
Modifies file permissions 1 TTPs 4 IoCs
pid Process 2448 takeown.exe 2580 icacls.exe 2520 takeown.exe 3040 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\wshtcpip.dll NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe File created C:\Windows\SysWOW64\midimap.dll NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe File created C:\Windows\SysWOW64\ws2tcpip.dll NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe" NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "OyVh.dll" NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 468 Process not Found 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe Token: SeTakeOwnershipPrivilege 2448 takeown.exe Token: SeTakeOwnershipPrivilege 2520 takeown.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1816 wrote to memory of 2604 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 31 PID 1816 wrote to memory of 2604 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 31 PID 1816 wrote to memory of 2604 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 31 PID 1816 wrote to memory of 2604 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 31 PID 2604 wrote to memory of 2448 2604 cmd.exe 33 PID 2604 wrote to memory of 2448 2604 cmd.exe 33 PID 2604 wrote to memory of 2448 2604 cmd.exe 33 PID 2604 wrote to memory of 2448 2604 cmd.exe 33 PID 2604 wrote to memory of 2580 2604 cmd.exe 34 PID 2604 wrote to memory of 2580 2604 cmd.exe 34 PID 2604 wrote to memory of 2580 2604 cmd.exe 34 PID 2604 wrote to memory of 2580 2604 cmd.exe 34 PID 1816 wrote to memory of 2628 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 35 PID 1816 wrote to memory of 2628 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 35 PID 1816 wrote to memory of 2628 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 35 PID 1816 wrote to memory of 2628 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 35 PID 2628 wrote to memory of 2520 2628 cmd.exe 37 PID 2628 wrote to memory of 2520 2628 cmd.exe 37 PID 2628 wrote to memory of 2520 2628 cmd.exe 37 PID 2628 wrote to memory of 2520 2628 cmd.exe 37 PID 2628 wrote to memory of 3040 2628 cmd.exe 38 PID 2628 wrote to memory of 3040 2628 cmd.exe 38 PID 2628 wrote to memory of 3040 2628 cmd.exe 38 PID 2628 wrote to memory of 3040 2628 cmd.exe 38 PID 1816 wrote to memory of 1988 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 40 PID 1816 wrote to memory of 1988 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 40 PID 1816 wrote to memory of 1988 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 40 PID 1816 wrote to memory of 1988 1816 NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.068b83f680d3ab641976172c38e4b2e0_JC.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD53852f0bec77a47054045588662ab0303
SHA1c5ecfabeb935b1baaff2dae8394e1e09bd3d782b
SHA25682bd4f26b5df0d73881c95583536f5149701e945359e30d0b16b391f6c86db5c
SHA5128c1a2d858a57489b7e86d8bf5395b2a18a8d378b1207366fdc672690e389f85620357d5768144fe105b1ab4654a1cb51284459c6859d8aa8a3fe848bf6836754
-
Filesize
181B
MD53852f0bec77a47054045588662ab0303
SHA1c5ecfabeb935b1baaff2dae8394e1e09bd3d782b
SHA25682bd4f26b5df0d73881c95583536f5149701e945359e30d0b16b391f6c86db5c
SHA5128c1a2d858a57489b7e86d8bf5395b2a18a8d378b1207366fdc672690e389f85620357d5768144fe105b1ab4654a1cb51284459c6859d8aa8a3fe848bf6836754