8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c

Analysis

max time kernel
153s
max time network
170s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe
Size

28KB
MD5

79a53118e69caecb6ae73f9414b77268
SHA1

932393ffde95360a05366ac5da68b97479603350
SHA256

8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c
SHA512

4f5a35b5e394668a459c6297eb17b63f5bd8b36eeef22c9142d3dd8684e8099dbb135eb52164e101e3a043451970f78f3128d04e0ae71db40ce77efa230262ec
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNUSGu:Dv8IRRdsxq1DjJcqfWGu

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1204	services.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012311-55.dat	upx
behavioral1/memory/112-58-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1204-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1204-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe
File created	C:\Windows\services.exe	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe
File opened for modification	C:\Windows\java.exe	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1204	112	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe	28
PID 112 wrote to memory of 1204	112	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe	28
PID 112 wrote to memory of 1204	112	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe	28
PID 112 wrote to memory of 1204	112	8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe	28

C:\Users\Admin\AppData\Local\Temp\8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe
"C:\Users\Admin\AppData\Local\Temp\8642b5968cb0726f01298d176594986b338bf2ca41d355e2f422976abeae049c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
cd126035296c1d4f5375d1dab65c1c83

SHA1
3b5aff13ac029906f0f598b0dfe4aa4613598eca

SHA256
677ccd3e421276f8325871275f0301379a4e68f9c7bf763a6084aed6ec60eec9

SHA512
26054b313b125398ef57fa9c57ddbcec0875c664047ab29ffb832bd42162b6ed5dcf898b7ae0b81a05a7898225ac90658c2d02db338dbd6d7daa7d8c5653b6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
ad4488679a7467a59836e47ee8d8cce7

SHA1
bc37681e2fca3fa570eae85c83b6ef5741850cac

SHA256
975499ee6b81dadd08892bdfd291d86cd14479c6a024b0476897c30b1b2d2450

SHA512
a936ca025e60a1765eb09a8ffef16ae72e739e9337aa69965ac3c39a887bf9090804ed3017c5a267eaac9522652658ed9a317a166518292465bed629fbf6aefc

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/112-58-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/112-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/112-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/112-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/112-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1204-57-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1204-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1204-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download