79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe
Size

28KB
MD5

a1aff49f6a41d29253fe8ef8352beeb7
SHA1

07a89d2aa22f387cfc516082f5666b6b21531c69
SHA256

79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e
SHA512

68573ddd32dd2446807f1589a9bbf277d2d5f1ea59dbb11afaf7deb022f4293ad4e746a554a7f14a5451c46378340b6d1a6abe1949b4dd95123cd1e3f4ffd7cb
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNGs7r3phv:Dv8IRRdsxq1DjJcqffCzphv

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4964	services.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1344-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0002000000022ddb-135.dat	upx
behavioral2/files/0x0002000000022ddb-134.dat	upx
behavioral2/memory/4964-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1344-138-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4964-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe
File opened for modification	C:\Windows\java.exe	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe
File created	C:\Windows\java.exe	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4964	1344	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe	83
PID 1344 wrote to memory of 4964	1344	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe	83
PID 1344 wrote to memory of 4964	1344	79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe	83

C:\Users\Admin\AppData\Local\Temp\79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe
"C:\Users\Admin\AppData\Local\Temp\79c403cf7bfb43356cc397ddafa1bca54bcd41d798e89e218d7e4797321d572e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
80b94312c2eb4175cd32997268491d95

SHA1
180e47bfd81127ccc6b16d77780006b6efc39303

SHA256
6abc9e938216a512c07d54d13512e497afb0ce8ec153a0500800bc83b90dfeaa

SHA512
c0f4050938c7590ebd7eef267bd9ab9d53441a8a1d8c8f2548f129f1a892f4e05f547fd61458cfd0a2a7ec0b77d3ce00d9db09c9e9b2d1017d24f1f7f201da5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
d5eba57da620f0800ecda00342e666f4

SHA1
598d82008802faab11e8089b6c966601fc7dd1e7

SHA256
f00668e949f52ae45d248e1f05ddb0654fb6ba08ceffe46cd0502a1a1dfb47e3

SHA512
26061047dd3f8dcf1565999688e176f7c1f342ae579a16cbbe22c669157661cad3949796717f0225a5e22d1f5e54ddb5910180d3bc1cfe663ead65c4d9782378

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
4702ade8e356c11e6020c7f06e569126

SHA1
f27740b03abffc8c42a6554a3a46c8ee14886841

SHA256
afed617367f44c82944c183fe85e06bb47ea4f7ac198faaa891812d9fcb7f540

SHA512
eab1aec5f5aba8d121d22b8051c7351352447e72669a50c48ffe5e9fe99fdc8f14f2360799e3722878cf0231c04b3086df204dce918e4ba80a9ebf483dca1e08

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1344-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1344-138-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4964-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4964-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download