faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe
Size

28KB
MD5

817b3b25caf77172fc834b6f27ce76a0
SHA1

9a8b77d78a2cfdcc09bc27746d3586d75a886d86
SHA256

faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382
SHA512

1b7820c26d44fa3395f157d4edb152d7fb706f2d1050aeb02be7ffbff2d48508a24079330dcbc6a2191d4f66c96d6b87d9940c03f2142428219eaad49369114f
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNScaIUv:Dv8IRRdsxq1DjJcqfxce

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2056	services.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/392-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0006000000022e49-134.dat	upx
behavioral2/files/0x0006000000022e49-135.dat	upx
behavioral2/memory/2056-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/392-138-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2056-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe
File opened for modification	C:\Windows\java.exe	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe
File created	C:\Windows\java.exe	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2056	392	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe	81
PID 392 wrote to memory of 2056	392	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe	81
PID 392 wrote to memory of 2056	392	faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe	81

C:\Users\Admin\AppData\Local\Temp\faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe
"C:\Users\Admin\AppData\Local\Temp\faeb60ed0caefb436eab1a198fba6b15558d7ddd34fc71246debe924380ec382.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f92ce2d5dffba0a7d3292f8e5fe93bfd

SHA1
63f9bc88582d0e1e2f512f4aeda00f526f36c0fb

SHA256
ba9617aabfcdef791fcf392d6fd31ca6c29a18ac326e64afa79bbe42c1b610a5

SHA512
04a7e258a96abccfc1eb58b2253ad7e03d1bab82f8e418bb8fb69622b1d5197fda17fde25f58cb3530e1549d7bed69a99d0b0c6908e934aeacf5d0dec4660ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
60f840d14970a8e249cb4f0e8c231b73

SHA1
e1cd34cbcbf8b9da2ee116f949ff6b0ae53b8385

SHA256
d35944ec8e0166ea2149a24e76dfe291ca44da787c8ff734837d4bb98f7c1e47

SHA512
2b167b6cde996de17716fc4054596bc96831ead93370da28d82e778ca87f1b013d00a93ee2dc28ba5ac2e955abea9d8f81dfe31212774f0574af6af124c83bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
1add3f543b9328c3180c672283e46d07

SHA1
fa4a1491cc62562e0c66553d1460fed2ade25470

SHA256
0a31edbd0b03a75b745f29d058da4592e6f9122d162c02505b5e782c7d1a84fa

SHA512
40db9d07b43b125bfad924d92dfb9c2907cf1e9969fe77b73cd9d508e6bf217fdd693197de9e889d5c092f6353e3c2faf3b16cef4c738cb629e74dfca1b8299a

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/392-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/392-138-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2056-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2056-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download