Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04-11-2023 19:16
Behavioral task
behavioral1
Sample
NEAS.148c67a603e0e57a4229e684fa682680_JC.exe
Resource
win7-20231023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.148c67a603e0e57a4229e684fa682680_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NEAS.148c67a603e0e57a4229e684fa682680_JC.exe
-
Size
2.1MB
-
MD5
148c67a603e0e57a4229e684fa682680
-
SHA1
48736278edde5ab28ac9ca6e8e13a3a535ba0cf4
-
SHA256
d80703175c17290f6e30090bdb2d614477b61606803b70c4a0fd1a2d9176f3a6
-
SHA512
b4bb36be578b822dc5ff46d69948119f7a09c24e36a9670807e91cec5c30d9a3c04dc610e188096191cf5fba76d64daaf8ecb422c9a45e7688a21a3720b15732
-
SSDEEP
12288:go3CPQosVhgwPsTce6EbNidvL/JM7aIrVQrE1SpYQqLWpc0qpb0qD0xcS:zbTP3uIlMnUE1SpYJLMq2qDFS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2456-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000b000000012267-6.dat upx behavioral1/memory/2456-513-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskcopy.com NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\RmClient.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\systray.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\DisplaySwitch.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mcbuilder.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\SecEdit.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\driverquery.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\MuiUnattend.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\netiougc.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\dllhst3g.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\charmap.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mobsync.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\RpcPing.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\unregmp2.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\winrs.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\lodctr.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mobsync.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\rundll32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\tracerpt.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\icardagt.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mshta.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\msinfo32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\relog.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\RpcPing.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\setup16.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mstsc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\rrinstaller.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\recover.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\unlodctr.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\wextract.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\AtBroker.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\choice.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\eudcedit.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\explorer.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\makecab.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\mtstocom.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\unregmp2.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\cmdl32.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\ctfmon.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\netbtugc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\odbcconf.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\rasdial.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\SearchIndexer.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\cipher.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\cmmon32.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\esentutl.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\SysWOW64\makecab.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jre7\bin\rmid.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\7-Zip\Uninstall.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jre7\bin\java-rmi.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Windows Journal\PDIALOG.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\7-Zip\7z.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jre7\bin\klist.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Windows Journal\Journal.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Windows Media Player\setup_wm.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\autoconv.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_c80d81c947c7b794\HelpPane.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_8094bd7b62d2b435\ImagingDevices.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_6a5b38699f97e38d\imjppdmg.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehprivjob_31bf3856ad364e35_6.1.7601.17514_none_53393627486ae37b\ehprivjob.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_d9c7c4a2e721da7e\dpapimig.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7601.17514_none_cca44baae0912bbe\Bubbles.scr- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\mcupdate.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\McxTask.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpresult.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcawrk.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_459ccaf008ff34f6\mtstocom.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.7600.16385_none_7f263a8951bc5a48\SetIEInstalledDate.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\ehrecvr.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104\sdbinst.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidcertstorecheck.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17514_none_fb3795fb0be32033\WUDFHost.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_df35b5ac03866e22\AddInProcess32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\mcupdate.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\ehome\wow\ehexthost32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\twunk_32.exe NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\xlog.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_924b83b9b69fb351\ddodiag.exe- NEAS.148c67a603e0e57a4229e684fa682680_JC.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5c35e8d91ac671a386b02ae331b37b2d7
SHA1a1ca0e2665bef44f5182975bc60db3065c05fbba
SHA256fdb0ef1f8a0edf06b34f25cc87b441c1fc7ba70404bf3958fd288416187836be
SHA512ef2329795ef4e767eb728d316db8521f4f83f9a841535146cf380ca7f32be3a2f124b3585932ca14526be08ff579ee896463cf5561a13366a5f50cae6df64360