3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe
Size

28KB
MD5

92951efa71bebf93c51e46a67547315e
SHA1

d625030b4e70cc394fa74c9330cb7c1e2d02b09e
SHA256

3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec
SHA512

4c2848db63369efdb59ae15c8d10d138f88b36729d5967d28a0bc6338f98a9f544d06708feefae368750d0bd5ddf853db17b0f1c4efa7eed70fdce25d6643868
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNF5IahZ:Dv8IRRdsxq1DjJcqfrS

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4112	services.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000000727-133.dat	upx
behavioral2/files/0x0003000000000727-134.dat	upx
behavioral2/memory/4112-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1824-136-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4112-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe
File opened for modification	C:\Windows\java.exe	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe
File created	C:\Windows\java.exe	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4112	1824	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe	85
PID 1824 wrote to memory of 4112	1824	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe	85
PID 1824 wrote to memory of 4112	1824	3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe	85

C:\Users\Admin\AppData\Local\Temp\3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe
"C:\Users\Admin\AppData\Local\Temp\3328598581ef1c75fea46cdd090f49c160683e31dbe6eb1dd54b57dadd916fec.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f265f558ce5fae200f1948df8df18a04

SHA1
60adb654043120d26b1bc0f8db10375c73175e60

SHA256
a53e3858ddfcd5cbac1bb97dded2a9ff77e7955175d8766c77137e9350f7375d

SHA512
4a74ba791967358f0c0ff0f32d24a3c452c082cf7a1909dc9eb2d6804bd29735dfd0a078f02841d4c1b8e0925a706f30d38ef429a891f67dd37fd1e42cf02939

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
62f3f63ed07a153efa7916c8276a9ce9

SHA1
3459d6a184738d394d880dd00c0d8d07315c7451

SHA256
160092481f13844a4678a29073bc7fbc9e60c2c2e45c822f00b5abf199bae652

SHA512
33db9c279ad099e86e0facb108848b65872e67085b0930cd345a1d94f9eb7bc9ffd5df9cb639da92e398951c10fe83bba037b6cb85d9c5cb37dc32a043cf8ae0

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1824-136-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4112-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4112-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download