Analysis

  • max time kernel
    174s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 15:42

General

  • Target

    a06aa7e34c272d37d95d86578c5cdc5eb9db7c9e702b7b5b980681eae45db5dd.exe

  • Size

    28KB

  • MD5

    621f28c5d932019dbadcf0b437b19afa

  • SHA1

    c63c40ddb2f42f60f31a7f53aa80b474f1065487

  • SHA256

    a06aa7e34c272d37d95d86578c5cdc5eb9db7c9e702b7b5b980681eae45db5dd

  • SHA512

    41359c4f71199f2bab3686776d12c314c91eec6fbd059530133c435afd4357b813638266390db0cfe0d6abfd3d215725df692d44cbd83ad082d6056282589127

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNl6:Dv8IRRdsxq1DjJcqfG6

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a06aa7e34c272d37d95d86578c5cdc5eb9db7c9e702b7b5b980681eae45db5dd.exe
    "C:\Users\Admin\AppData\Local\Temp\a06aa7e34c272d37d95d86578c5cdc5eb9db7c9e702b7b5b980681eae45db5dd.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:876

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    3ff1085d366e912f000bd9684a5bca04

    SHA1

    fe22bf260fac15cd4602380055b3667add494bc3

    SHA256

    be72bd8e97bb54ee767b7c95373c2cc1b93ce78668c74b61d73b088d34771810

    SHA512

    75286641d1f74de216ade285fcc5b795e673bdb425eb73eaa4e5e4ab93f5850156d965609baddab21eacdd905f8ee69cb4047c6b75ee3bb83e0d073be3e9eef4

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    7b26f4008bf14d6d6d8342fabc353422

    SHA1

    9d353f6a98ce96d554897fc660484d44230493b4

    SHA256

    f3f9359142b262fe484e6dc57f6ccfb791f26b7aae76c58fd2e11fe2a7559f01

    SHA512

    5e78c01e88f8c15d916ba9f4d4b59cffc42818dc1ca0ea22ed3d0722a6e2251a1749491ef336e9ec754ebc5a63ae5313bb406852971709d8fc6e2c6f4513e057

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    c9a1e973535f9337ece89a3f4c7bf7d2

    SHA1

    ee843cbd4010a67ecd1ce366e527d72439b7ebc5

    SHA256

    df0c17648ec47c5ee18ecf9872c470bcc6f5207368665fa319365ed6f37c035e

    SHA512

    d964a461ef258e6ecae631c77cf612ad64a948f9843a7179c50c37c2b49dd3622e2c262f4d095dd2ad504ddebdacd9b9ab80be6fd96673149edc5bb7715c34da

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    f3ce1ccd71d054acb1765f52cfef39de

    SHA1

    79e546c48c9c46ee12143894e6a5a274d65ab0e7

    SHA256

    2f1651af8172a98dadde03e2c1ad26fb64e0269e19df1bddce4eab18b797ca38

    SHA512

    1855cf0055f4c97017c49e52303ee112a76a8cfe05bf4818d824e54e942ee65f513cd6640835768f5505a400e21efcfce6706a1bec759dfaa805cc1c848e7969

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/876-137-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/876-139-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4824-132-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4824-138-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB