f5b27fb78e9386a3ba8a4af7c21ca971b24db9f0b26551136eb8ea8028ac3c2d

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe
Size

29KB
MD5

768af9a1469c7cc4e9b726dd1a4373f0
SHA1

4d51023c0ebc3b89b198a761e151090c94b53a59
SHA256

f5b27fb78e9386a3ba8a4af7c21ca971b24db9f0b26551136eb8ea8028ac3c2d
SHA512

f65ee2affb725a1de01c6339d71146a775c852aafd4f5ca066be2c122fa63160473462040f723fb87d92d3939544156b1894be330ef833152725f2f945466578
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/j:AEwVs+0jNDY1qi/qr

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	services.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3128-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0006000000022dea-4.dat	upx
behavioral2/memory/944-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0006000000022dea-7.dat	upx
behavioral2/memory/3128-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/944-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000a000000022e10-53.dat	upx
behavioral2/memory/3128-99-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-106-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-156-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-221-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-222-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-264-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-266-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-307-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-308-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-360-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-361-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-405-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/944-406-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3128-437-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe
File opened for modification	C:\Windows\java.exe	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe
File created	C:\Windows\java.exe	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 944	3128	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe	86
PID 3128 wrote to memory of 944	3128	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe	86
PID 3128 wrote to memory of 944	3128	NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.768af9a1469c7cc4e9b726dd1a4373f0_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B5FYTYSL\default[10].htm

Filesize
306B

MD5
550379217493ee8717fc3e3d4fa13cac

SHA1
818a353efc5e626fb3994615e75cf98ed1ed77fe

SHA256
f80e2736a817ca49088e7f671f832dac4566233b1c9c1c75d42308bf6705e56f

SHA512
dc4715dabb40202e454d501430a64f16704200c17d05e8209ac9e331edab4834daff25f572ce18031e4a2ca112d5fa2098b982f870e021ab9d1b3ce6497abe4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B5FYTYSL\default[1].htm

Filesize
305B

MD5
46e42f26c7218d036d9d0608bfc83bbe

SHA1
9d6b068eaed89ceedda9e02e59cffdbdb8eb0207

SHA256
5578c64b4212b92c66773c8a2734fb1bcdc9a97d809417589262a5daefa866ef

SHA512
4fcc58402739d520c04d65b54584c4f0267779d244a73b22a2ed3bc502ae991524a7aaf768e30fdaa7c88803270f8494195ebf7aefec51624eeaab80df47083b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B5FYTYSL\default[3].htm

Filesize
304B

MD5
8251fff4df202c8d6dd6aaf34f4838ea

SHA1
fa88f08dfdeaff6b86873d447fd26cb7d83a694d

SHA256
a17db628f6bdbf4cdc6fe029542404867306406510dbbdb57a047a75ac294962

SHA512
e9c0fe2a920377777bdda16a8744cf80d15e1d1b3c94b704f8a4c4cf54d2529ede4aea8a2d6d38f4e3c4d02f602edfed659db6613ac7c374e5214a201f16a3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B5FYTYSL\default[4].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRUT4RU0\default[1].htm

Filesize
304B

MD5
3483bf8f41c9a3b9c4acd2c9be5d8d00

SHA1
fe960cf9b9744217b295ed86f66e80c58c4d6052

SHA256
9b402b64c9cddf2ce4c139df23fd6354b51bb218706076d0b6ed1c128df25535

SHA512
1df7f496dcd70238c3982e595964b552548a7100f3b238a65476cc57fb10e3e1d82c19ffc3f4d61ead29657623665126f3e09561bc0feb39f3aa189f603757db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRUT4RU0\default[3].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRUT4RU0\default[4].htm

Filesize
302B

MD5
485828cfdc2c1efc0c51ff9b74dd34f8

SHA1
6f685134b031e9b2fff0eb8c7212c99bfba3719f

SHA256
615a15f6247f8f979b3a066801c98489018b1d137fd5d9b7bce73824acc70f06

SHA512
69736b9700c2f47feab282d8bf8bd6f02c9f62ecb9c02466b6cf76b1cd4b1becc70803123e73427c871c2aeb2eb64540edf95a342f78d9211ac0571e8fd1f426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J9NF6NB1\default[3].htm

Filesize
303B

MD5
0a53779b07f9c9c56ef169499851915e

SHA1
281bf81610dae812be159f95a0858f88f9b96637

SHA256
b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1

SHA512
5a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J9NF6NB1\default[7].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J9NF6NB1\default[9].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J9NF6NB1\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XV93K3MB\default[4].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8D3A.tmp

Filesize
29KB

MD5
f0caf5d7cdf83ce63b293b2e4173aa8b

SHA1
4167f9df36b9ec00729da0bc7cf357b3e9680bbb

SHA256
a820676266ef1878799e1bec20f51c35d8377a4b3d4abf4674ad891dec8bc915

SHA512
56a6b9316e882dab0792ecc73be286d10fbe1fd041250cfcb5a310d3cdf1c6d4d20ab19133fb8fed2964f1de780e47ee01fa114acdac64d0875e484a94ff73d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
416B

MD5
f8effeafc0667b3d961a2bbe20dd19a5

SHA1
c3b50c1d681ccdb1410b9d004097b4d26b828c64

SHA256
15a588f092d1d6762576c88afd5b71e8c7c90b0214f223ac17aa44cbf1794afc

SHA512
8cf6ec2f665d7071fe2b08ac0378abc6f3524320daf5d666eb79b8c2fc0c39d2ba3b31bba8404255393e427f5dd679cbf38b954b4c4e0632018158a89ab1e123

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
416B

MD5
44cd27e8890e542ffc80ffe151f41959

SHA1
abfcb9392cf312505dff36296f83dd49e009f630

SHA256
70b435e047518c768e3bdcc76aa4c8d8d31e5975dc71733fc52d629c06b2d96d

SHA512
44da997dcee80421d727fb47c3033ad178214e8852b0de09a7944ebe61f13168728834b05537ec81a8c0e9c0cff216425aca430bfa6f0abe8efa62a0aacb1762

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
416B

MD5
b92bd5a345971cc48f1df838629cf461

SHA1
d25df5c8e65d9fc35b8c0ae280c6770d1be8e8cb

SHA256
f3690383dd2dab62bcc9dfae9c6f86364587e0c060c9203178788e9f9061cb91

SHA512
6340c3ad9dc83f690820d39ee2f8149abe98fecc3a6ba522d1f184bd6de9fce27ca96944366fb1c0cef6f1427f0dfd34a307c6ccce19752f8edd090e29e74d50

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/944-308-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-406-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-222-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-106-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-266-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-361-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/944-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3128-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-360-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-307-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-264-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-221-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-405-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-156-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-99-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3128-437-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads