a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe
Size

28KB
MD5

81b859aade3d6af0cf08be774bde8d20
SHA1

c7c2124a47233d2995182b6fb84ef66d664bbf37
SHA256

a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126
SHA512

39949f67ffab86d96e8ce52b42c8b692f689fe85134bebfc142a9d52004057b84a25cc8315b7b93a92d15a1339eef20533d71d7919ed73c84743b3f3845812c2
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNRs6Q00:Dv8IRRdsxq1DjJcqfQ0

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4492	services.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4276-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0006000000022f63-134.dat	upx
behavioral2/files/0x0006000000022f63-135.dat	upx
behavioral2/memory/4492-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4276-138-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4492-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe
File opened for modification	C:\Windows\java.exe	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe
File created	C:\Windows\java.exe	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4492	4276	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe	78
PID 4276 wrote to memory of 4492	4276	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe	78
PID 4276 wrote to memory of 4492	4276	a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe	78

C:\Users\Admin\AppData\Local\Temp\a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe
"C:\Users\Admin\AppData\Local\Temp\a81fdf859300508d0ef24c16c13b3adb1a19cac6458d984649e0b989b5144126.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
2a568cf47e1942b1175197bbc34309c3

SHA1
1448207f4520c6eb886826c90f6c105efdff0e0e

SHA256
ff97ee98d5c6b3005508873bf13cd6f3107a4b3b1445d20acc7bce28f3602fc4

SHA512
e605e211c53cf76dbec4bac5b03705ac0b8de18b1d0801dccd59eb1bbf739ae15a0add182c4282814118c9a1de16838bb0cc0556ee890bea593ffab1d69c9f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
26dfa2c97ef83a02ae50a6e0fa1ba485

SHA1
63e99927c17e4fedc03b1f5c74f3cf43b907fe12

SHA256
b23683476e8a917e8beafaa971971600f65ae1641b6f9f571ba7faf2e8406ea3

SHA512
b40e653e01ce2e9ff99425e17776658190b3dcfc9ca3b629b1e0942f29c5e67ff89e89349cf2a006da654a107279087a11e12d4cf1ebacdb83f6978bd111b705

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
13bc82f735cf381b294223b75598db77

SHA1
92ce10072f923f15ad1e7c81349d9d391aa0d968

SHA256
16984266d54639f66440756bd1c73fd2d00fdb24beea6422ff74398bbcdae4ed

SHA512
2cec8a9f6be768402c69c3858ff5bde57a79f07c27c4f34ebf77e9fd3d28cb4575813a86de14f538bde44ddaa80c9419f1d76bd57a55d859c797e744806cf256

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4276-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4276-138-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4492-133-0x0000000000000000-mapping.dmp

Download
memory/4492-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4492-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download