c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12

Analysis

max time kernel
153s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe
Size

28KB
MD5

60397a99ea9af6437d1006c59bc848fc
SHA1

4c1d986a687ea4bbf6365c85a24f56f2407eb60a
SHA256

c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12
SHA512

a0cf282d8981fdbe8a87a7f81d702eba9b64485d1bb2697a210bb8518e1962faefd7ef78fa750561f5b53996a52579a955b33ccb21eee496ba52b26ee0e8991f
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNB:Dv8IRRdsxq1DjJcqfe

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4376	services.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e39-133.dat	upx
behavioral2/files/0x0007000000022e39-134.dat	upx
behavioral2/memory/2064-136-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4376-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4376-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe
File opened for modification	C:\Windows\java.exe	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe
File created	C:\Windows\java.exe	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4376	2064	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe	82
PID 2064 wrote to memory of 4376	2064	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe	82
PID 2064 wrote to memory of 4376	2064	c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe	82

C:\Users\Admin\AppData\Local\Temp\c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe
"C:\Users\Admin\AppData\Local\Temp\c9b574ecdeda86f16921fa8222bc9189b84a78c04f39a8d7b4d1b480aa4d5c12.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
bbd737bb2aa9d627683a9753137d824d

SHA1
4a0067746a2b4062459435a01c204730617046ba

SHA256
24e0546d0123e8d1a11866b71379d779a84b8631e97fb6b2857e0b8483ffe8fc

SHA512
8356b5f76abcc3992ecd1d212b4b58973b68cf51fce1ed22dab8986316a7ce3fcf7589c839e66c8f954817522c98082d018c350be9c7c318b550a3c962747cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
af0bef354e3df3a9ae840535820415f0

SHA1
8e86d934a4359664a35ea3bf8519591528f3192e

SHA256
b858b4cce191f29d09c68bfe506f14017c05c54af4c0c7b2036b7bb58c0bacbb

SHA512
37a9d117adf31df60a81d965322fd307f8a32af994aa34b4e8d36e64114413245deb7e982bf3a7751c4e832e49cedc5e24f7fcca4d709453102b4f43f67f1f0d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2064-136-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4376-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4376-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download