a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe
Size

28KB
MD5

909324cbeea3bef6d3c4d009d4ef00f0
SHA1

04b92c25ad0ce96c5a2841791f00b911b3f9092f
SHA256

a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa
SHA512

fcac72cc65d822a2780a85f27a5a4a508537767aa204da32d0a96f254d6c0d74fe621213403057ffc633a432b575030bd91986dd5fa1ea43353e17f74a2176f5
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNtC5t:Dv8IRRdsxq1DjJcqfgkt

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4900	services.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4652-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0006000000022f32-134.dat	upx
behavioral2/files/0x0006000000022f32-135.dat	upx
behavioral2/memory/4900-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4652-138-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4900-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe
File created	C:\Windows\java.exe	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe
File created	C:\Windows\services.exe	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4900	4652	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe	81
PID 4652 wrote to memory of 4900	4652	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe	81
PID 4652 wrote to memory of 4900	4652	a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe	81

C:\Users\Admin\AppData\Local\Temp\a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe
"C:\Users\Admin\AppData\Local\Temp\a8f47f3c43d101017ae1a0c9be25cca772821cab775193cc50cb8082e9380daa.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
962f4852ed4da63ba6456643bc13e5d3

SHA1
0319ad1989b67a41cfb31ea5438c6f12cfd14d6e

SHA256
d66f4ba692eea5f07ead53b8abecfb9573f6b096a86b97a1c15693c14014ae51

SHA512
df42d9305f94a041210748c5fe3a899ba07b3575a8b5a4e6d772d3fba48a870c37801b1b21a99175221d6caf27c7e6d4413a9e20927be5540ae8a87532b01688

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
0a433372c0c2fe46956fc455142c063d

SHA1
45217277cb613477bcd865641f83e8b19afd999f

SHA256
f80682aad806a96cedcb70f526bcd0a7686718f1d3142508f7b609eeea24ce8f

SHA512
5d352187052836e03e576cc26c174edcebe7fa36b4ad0bd7fed86e4523923615897e52f7cec19525b78aac4082440cb49cb8a89643f75c42de2fb69d42720f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
a964bc9aebae5ef4e7bb2a11ff114ba9

SHA1
e2260dc0b53f06558f535c341636ad1e3479c71a

SHA256
238c0a6d6d1f4f68bea2fca2368a93001c1403c75285aac4dd2f7f3d2aecda67

SHA512
1111ad980ce249e7b5eb4c783ac360f1a6d6455776ca8375faf931fc0b28c8d624697ff034cc78d713fb5044f4c17ed1a25cbae3bc230d81b2e54bd41c81704d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4652-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4652-138-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4900-133-0x0000000000000000-mapping.dmp

Download
memory/4900-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4900-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download