bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed

Analysis

max time kernel
153s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe
Size

28KB
MD5

893222394e099650c578dc745a360e1a
SHA1

a77030b24363b29194282ba4a25cfea58ee6a857
SHA256

bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed
SHA512

f78d427cf3a39609020e593eed522afba30fddec681d53e10d9312156810041cb3aa5485428bfc10d0110e0e0c668695911c6e888498c7f72cf2089130d36787
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNGtT+:Dv8IRRdsxq1DjJcqfN0

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4644	services.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e29-133.dat	upx
behavioral2/files/0x0007000000022e29-134.dat	upx
behavioral2/memory/4644-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4744-136-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4644-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe
File created	C:\Windows\java.exe	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe
File created	C:\Windows\services.exe	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4644	4744	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe	80
PID 4744 wrote to memory of 4644	4744	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe	80
PID 4744 wrote to memory of 4644	4744	bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe	80

C:\Users\Admin\AppData\Local\Temp\bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe
"C:\Users\Admin\AppData\Local\Temp\bec670a68b38ec702d7aa365e6966fc16a7c9ab3930364519914681d7d5a1bed.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
1a7429c7ae0d4efb4ca67b3464cac7ae

SHA1
cb167dfe36ff382ef5f16c83423002e8fe95af81

SHA256
f79a72e3dc8643ffe19fa1a590ff5efb86a604553d2011998b2434abe9ca823e

SHA512
0fa3fc0d928d302390f86b3f3d8e909ea3258c6a217feeb9350e3cdd39c6fb117f117c79ec3e5e1cb99515115a4234cf7c6f0b29d26ab48c2d877079116a4da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
48306fc0f919593bffa169d8154e8977

SHA1
c717412491517e464b708dd3f66ec975151a705f

SHA256
3b18683d9d90ab68b11954e542f14c53880a296e1c1690ea2eef1111b0544dd2

SHA512
0dbad59db7e170c984e6cff0f58d03fb5acecf63e265bd55de30502cea055efa5a892779c604f9160cd657996bb7849b828b8c8f3cc9d6eeef00e69bfe72b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
26338a8d2f3890ac901335326bd85c1d

SHA1
3d29ecb577e855cf75ba4c9a0a3700421657d4a6

SHA256
38546b205034130d271a39b948f2264cbb1fbd4e92fd8eaf1b3937dd6f415d9f

SHA512
e1f2675743dc3093268fc6862f4402c4f01f79d8c1987050dabade4a315131f7130ca2dd5f2c50796993b046bb4ec7fee1c24ee41de7c8faefe47d3da800f6e1

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4644-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4644-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4744-136-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download