faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8

General

Target

faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe
Size

28KB
MD5

9362c19bf7f0e306efe1efb35976de7e
SHA1

f6b529230f138faf1b785d6e203c1996e92dab9e
SHA256

faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8
SHA512

636ffe6e35ad45d9876a802735a9118393f84ec381ece3f5173c1f60d3407a87bbb52bd00ef4a7290ef5b3798f59081371d4296d59d6c8e197e565437b4f4932
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNrE8Cz:Dv8IRRdsxq1DjJcqfeER

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
468	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00090000000231f7-4.dat	upx
behavioral2/memory/468-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3444-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/468-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3444-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/468-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0007000000023399-60.dat	upx
behavioral2/memory/3444-132-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/468-133-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3444-168-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/468-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/468-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe
File opened for modification	C:\Windows\java.exe	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe
File created	C:\Windows\java.exe	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 468	3444	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe	88
PID 3444 wrote to memory of 468	3444	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe	88
PID 3444 wrote to memory of 468	3444	faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe	88

C:\Users\Admin\AppData\Local\Temp\faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe
"C:\Users\Admin\AppData\Local\Temp\faf8001c7679f40182e3cd6acafa0a60733df27eef2a80fd531363aa1727b6f8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PICZ11Q6\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD83.tmp

Filesize
28KB

MD5
f9fdf1e94f449f412ace2489ce946d8c

SHA1
d2a73f7ef7c1fb851a5f8ce1d83bfee10eadf74d

SHA256
a3cddd2aafd0a916313b50123ddb8351d73342dce7b0d6b2bb687799c768a75d

SHA512
728803a18f271c209629276e19341bbe4e37bf01e968071930def2eb164eb5a96ab91253e762a666aa52115f5048a5442a72c20bd9ede0fbd0f61dddabce3f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
d42232a69862349186ac53c5eb9fb1f8

SHA1
dca89bd54021b82409a59c3cc941a06b0a56a893

SHA256
77fe9ab65cf6a3f4f5c428a93a93b17114656f9929557846ec266d5c1322457b

SHA512
c173855024f0b8cdf981e0919d2e93a5284923e0424c2d4ceb623530312b6440501e651ba42e9207898100ce8f13dee5efce014947f0a40b497676f85de22cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8220ecba98423ab37204fae9f57ff630

SHA1
adf3a0d602725ecea75768419ff8ccbe529c5d49

SHA256
18e76a045e08a54b4daf432025a370c018ba88debeeea5ae6c4d265b05b2e39a

SHA512
1376d4bb7296eca147e5eb4a3b7abc69bddb3fbe2e499f108dfdc44af1386e9fc878d1d3d019b5877844c3e40ba33145bd0aebe9a245f598822c3caf21ad5461

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/468-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3444-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3444-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3444-168-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3444-132-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3444-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads