781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe
Size

28KB
MD5

a019cf6356f6571a15886bbe26cf529b
SHA1

08ea0f4e3629e2f1eb5c03a4b736c30b192eefed
SHA256

781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44
SHA512

c620f11091462e8192c270f963a1eeafbf4f0520f5c0fceca01508b7541b5544caff3619d09abc38acc1cb4bebea8672c8db22184b08071536480a108edbb5b7
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNSU6bDBP:Dv8IRRdsxq1DjJcqfhblP

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4744	services.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1316-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000300000000072f-134.dat	upx
behavioral2/files/0x000300000000072f-135.dat	upx
behavioral2/memory/4744-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-138-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4744-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe
File opened for modification	C:\Windows\java.exe	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe
File created	C:\Windows\java.exe	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4744	1316	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe	85
PID 1316 wrote to memory of 4744	1316	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe	85
PID 1316 wrote to memory of 4744	1316	781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe	85

C:\Users\Admin\AppData\Local\Temp\781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe
"C:\Users\Admin\AppData\Local\Temp\781c045d888ca6401eee8b28acbe18073b97bf8398331f8ef284e96830c77c44.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
45fa2b79b475efa690fcc1e687155909

SHA1
05d046ce4c211fef9292d3b42b1b5a6bc1a05f4a

SHA256
9a04936c4e7a7a5eefdf2662b7c3c075dbb81e379a17c3c6773ad46b254973f5

SHA512
d9e881e4dadf18f2f8c41e8ed8c8cb6507b9fe5c243f5cc4107b28d6a9df7438bc1a691688093e6584d4b0da6663db9c0fee5ace649579688257138ae5d83e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
4752ab013cb1cf793fa574a02591bb6a

SHA1
2eaf87065aa8f31626f04cda9a1c71d8e1557235

SHA256
8927cbc3d8e521b17d6c26492ed35ece3a7a00a069aa18d6b6731fbcb45ee756

SHA512
9c2423150f3964e97dc28ba435bb58694c0ed65889313c726862ec4c99378b123810cee806961eb9bf41db247277f7bd51f592fdb8e50940793cd67ae1c73003

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
b69a602d36457c9805458ad464c4ba14

SHA1
8ebba29e33fa6654169fd00f7d6ace974c8cf909

SHA256
ca41c1d2a46f579c51c0aa9ecfb4c3303c5db02ed6da0b9c0f93ce30ff38ebcd

SHA512
0f4bc11eb3c1832785d106938974aaad8d953e7d0c773ed565f393de042209fcfa39a295e54824077001f748936d3a4121b82d512b6a55e6c42acdf2fc1dd2da

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1316-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1316-138-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4744-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4744-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download