5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe
Size 42KB
Sample240603-1zppdaaf7v
SHA256 5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77
MD5 5c904c484ac34f9a9256665eaad0e928
SHA1 2c8f053fc5fe4fc031888adaf963532521f83aaa
SHA512 3d404d217a8bb400f11883024b0f90dcfb8a896d5a0278599c62187e56bd7b17b98cf706a3b10f66f9b90a38d10c653e9d11415fd3811b58f7f2f2ca5aa64c1e
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVHo:tdAkXGqECcwYgw9PNSa0Gko
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
4620	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000233f4-4.dat	upx
behavioral2/memory/4620-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-199-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-275-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-279-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-280-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4620-385-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe
File opened for modification	C:\Windows\java.exe	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe
File created	C:\Windows\java.exe	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4620	1232	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe	82
PID 1232 wrote to memory of 4620	1232	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe	82
PID 1232 wrote to memory of 4620	1232	5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe	82

C:\Users\Admin\AppData\Local\Temp\5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe
"C:\Users\Admin\AppData\Local\Temp\5d9417a06eb310b8b37118deb6da3904843856e8ffc64f836ac1d0f7248b4c77.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PVTNTOOI.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\PVTNTOOI.htm
Size 176KB
SHA256 7e62add1b33b5f0ec23733f8313cfa280ca4256b1eb54046b5caa481d0e5042d
MD5 7f578f93b02f5664d4a92baf58a9b262
SHA1 e06c262a184f40473a32f3cd9c7247f79eaf225a
SHA512 26d10d2baa802ce123e326e616167c5948a2d8a3d8d2a52fe68b300613449ab4df1bbfd3f5fc010b31c4cb20c49626c43c142879f38ac54c2bd5833ea7bebe8c
SSDEEP 1536:4jNDsVoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPsNuoamI1MGoamI1MdY13AR:OZIeGAzVCbS0ZK+QG58TJLeIetIexhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[7].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\search[7].htm
Size 110KB
SHA256 c0da8c629ed4f31e587ff8af05ce69ec569b82fd2860e627a7e4bce7c9bc654e
MD5 0998a2d53489dd7dc9e959e6072b1267
SHA1 be561a30e275613e568ce1d128082b7264a0063a
SHA512 69448e29720203afee47e31e9c69e523e7aaad6bbebf5aeca504ee550b974f88665257d6a9e69235e844a640eb3cd8291d67782e9c2603b671f63805fcf465a7
SSDEEP 3072:yWIepXFpx3chGPr3X21hfL898T8m8F8l8w8o8e3Ee8E:ygFzaojySN1yEjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchOI4EDBQP.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\searchOI4EDBQP.htm
Size 161KB
SHA256 036c7e064f883230eb503ba46b34d75dfe94122bbcb18222b61bb0760e08a4df
MD5 ac9b1800f7abfb856b33461981187f6a
SHA1 771278d73ad6686f30f2bfad064b6c8e0f7d22b2
SHA512 4f3d531451dd0a10ba84d0214e92fb123cda911dc5c72117de3200384514f79305521d3e214ea6b666bf16d02da89d313540a8497d8bb6724ca16a2ee8a4e3ad
SSDEEP 3072:QWIeL46WFkUOUuHYA/oAVYSF+kGEoWk19CzicYGN3Phtlgry618K8r8W8r81+ozJ:QpFt19cHnwzwIou8UM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchRK8LFPJV.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\searchRK8LFPJV.htm
Size 119KB
SHA256 d2f4c23daeb312104335dd29bcd39b076b2e9fbda71847ef9d5bbf2cb041b8c2
MD5 c6687219000d65f65bbe7dd2819e8bf9
SHA1 57f07d10dc499e677770f5f453299f53c0c04087
SHA512 9b73db6f4a3481081b56cad298553fc1a3a4850a1347291ff014897b51611e71fca7f1b33dec97f2b008cdf03b62fa0cbd720123b8fbf13988989d3e2a653e10
SSDEEP 3072:PWIe1+5nTVMrSYgxgBYoDrzNgzQjzOxq2gYwn1FGLI5gpAk2cBIL4YfU8oRzsnL3:PzWoREn
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchV9ST4DVC.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\searchV9ST4DVC.htm
Size 143KB
SHA256 0258d86fc0440d8ebae6a4d5d1ad9fb4d86bb9e030f3919dc475a6d2d1279f2c
MD5 14de7a3231273b8b8000facbfc3f2450
SHA1 37caf08123446b2846db4661cd74a2e0607b552b
SHA512 69ecc2f9d1c3b976ebeb5886e659fd5807958c28caa37298c6995841b1184f81630d75dc2d87e4928ffb8463d3012ebf8f9d47b3e20825355740234b70fb79ab
SSDEEP 3072:CWIe0H6GFNyCloUKdsYF5QcguI6QiFAqV828C80848S8n8p8C0H/vV:CTFrTPhl/8WRHnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchN07RLWC1.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\searchN07RLWC1.htm
Size 108KB
SHA256 8583834cc3b0255d4314aab96d83b1800be76b475e218b193bc5d226f0d7d98a
MD5 33864462f4af73b9d6fb2975fbf1bb6f
SHA1 3c1d7270be838c713838a33a0b1d05a805178de2
SHA512 3f600bf53f9c5f14178cff78e7fd2842064dbab4f2df5bc5d2fd3c35b74b996c3f5d05a047760ba75dbada0afa48c086c27701fee97bdb5590ba333aef88f6df
SSDEEP 1536:rA/DsqoamI1MR60BcdhqBvUubFI7V9yIYw9sZE8CG0XUO4QZ8I8h8uUhWv0VyDg/:OWIerbF/IYwGOFvXJzZ8I8h8tzjimV
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchYUIEQEBS.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\searchYUIEQEBS.htm
Size 118KB
SHA256 b5757642cbf2d8e2e75e5c0daa688278028d526614eff39a8db26a6462005dee
MD5 e3817a2048b6645b989cec9cbc89ce85
SHA1 3cb333f02fafe0d79308c6250de3cbefb9df118b
SHA512 a50f4b2232fc89d8a43cecab0b04310b4d35957dfd751bc1fe4c45252d6901346936c93c90785d27c50209f39e49d11e01105f14971b816a8a534ec4d34b3b32
SSDEEP 3072:aWIegFbtdhCVQgtdIxvLDK264YvtvecFau7Coiuh5ET:aAPhST
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\results[5].htm
Size 1KB
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
MD5 SHA1 SHA512

Submit Download

searchXJ3T84K7.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\searchXJ3T84K7.htm
Size 145KB
SHA256 7d4a19bc49e2e7b65d2516077af91508a085a5861f8d4e142ef1df19784bf865
MD5 e7295a5291076896f6293f209c638ea1
SHA1 32b0eccc19ce60d7f0b21d26e449aac999c9a8c6
SHA512 b60ff6a92058aa13bebe4ed178277c90720a2aa48a5fbbd3b7761f7e445cd4ac4ad53958cf0a4dfe3a332f6f0c361904af8ca23a2bfccb6b2e60a0a8a37dd25a
SSDEEP 3072:UWIeNYn7gHXUFk9o+Gonyy+jG9YXPyVeGHLcpV8f8a8i8m8K8YDbaGU:UnF5uhnkXvjnkb1U
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\search[2].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

tmpAC1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAC1C.tmp
Size 42KB
SHA256 961698f49503077e430a46a719e7de1eeb8b5383892742fd3efefcfbcea01948
MD5 96a439bc2d3fa03f9ec8a5b3e3350118
SHA1 e6e99247e1fabff344faef88cdca54d97feb7196
SHA512 8a989ccca379a38d6bc55401b16dc51d3772b1f3fccf5cf5b67be2794a709a9c6a5ba1b851853eb95a90f52ed73e7092e1310568358be7d8062455499f2d6c3f
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVmi:tdAkXGqECcwYgw9PNSa0GVi
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 e16dea3b22169a31b4dc0ac27344a269e536a36168bc731d2fe10e847412eda8
MD5 a372377c49f09197d99b2090073bd55b
SHA1 fa227b9dfed8365b4b4385776a7ef72229089959
SHA512 723140550375a2f0d6656093799428226142344cd7a44b9e198384134623bf734d7fc16bf04747a1002c1b1b6df27173eec07da60b8d4b9a59f78eb8eb431a4b
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 f4b0e41594260fa92184e2f48d8cf78695a36214b25dc5d7408b92fba58ef781
MD5 027decc6c3b3148de8c7c02154705bf6
SHA1 444f08b9bcc81397a2d65c18fb320047796a90ef
SHA512 8312337e2077019a6dedd361317dce3a426d8142c10e9285c1d9c3b4de35fa55e4db706b484818d60d82c35649f190b126fa62d0334e6259abec04732fe329a3
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1232-0-0x0000000000500000-0x0000000000511000-memory.dmp

Download

memory/4620-22-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-199-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-39-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-275-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-279-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-280-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-35-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-30-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-21-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-385-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-17-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4620-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads