Overview

overview

10

Static

static

7

e881eea3b4...73.exe

windows7-x64

7

e881eea3b4...73.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 05:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e881eea3b429ff189ef2819e46df43c9c78eabb1fd889cdae5fbb8e68c55c173.exe
  • Size 29KB
  • Sample240603-fnyspade94
  • SHA256 e881eea3b429ff189ef2819e46df43c9c78eabb1fd889cdae5fbb8e68c55c173
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e881eea3b429ff189ef2819e46df43c9c78eabb1fd889cdae5fbb8e68c55c173.exe
    "C:\Users\Admin\AppData\Local\Temp\e881eea3b429ff189ef2819e46df43c9c78eabb1fd889cdae5fbb8e68c55c173.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\default[2].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        searchQUSC2PTK.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\searchQUSC2PTK.htm
        • Size 147KB
        • SHA256 62a30af60c12c7fd4b261dcf0359b8fa1baee94b6721dd5f31ff6f6ef884966a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\search[10].htm
        • Size 151KB
        • SHA256 9612b4edc3f1c743c0b51d831fe28fce622b07744f7d66dc50ac7b1947bff81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\search[6].htm
        • Size 141KB
        • SHA256 769fc02f4ac0b3fe945fe884176c12d17cf34efbba99878c8200c144f340b31d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        14O11Z16.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\14O11Z16.htm
        • Size 176KB
        • SHA256 c43a1aea9355e7560cc678c43db961e7293b69b887f66475bc7b5c91e06b626e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\default[2].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search026SXF6Y.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\search026SXF6Y.htm
        • Size 129KB
        • SHA256 2bb453bab7ebb61472da1cbd51fe6d2ef0dd33f4c0000751a4e70712165ff03e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchNHVQKUEY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\searchNHVQKUEY.htm
        • Size 109KB
        • SHA256 00af17d9df8e809c5adae4e02cc093e18bb378d7ad3a50d89874961a9c99c2f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\results[4].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchN9NRN4ST.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\searchN9NRN4ST.htm
        • Size 155KB
        • SHA256 c2005e097c89eadefe0b1b2d80815b6e98039d48ae65a44f8986762317d0f0ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchPZO7GCX5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\searchPZO7GCX5.htm
        • Size 129KB
        • SHA256 3d2aa6985a2664fe4405cd5c674e40426f6db4983e33cdb4ba0ed011425b3be1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\search[7].htm
        • Size 112KB
        • SHA256 b643241c6d965c7ead43672dd9d98021b5c935762e3a9d7a117952ea31c63594
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\results[1].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search6KZ5TVQJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\search6KZ5TVQJ.htm
        • Size 116KB
        • SHA256 5883ecc93da4aeb4f2972fd0bb8e2c58165c4a6d681b34a5e54cb473106271b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchAZ8J4FPN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\searchAZ8J4FPN.htm
        • Size 153KB
        • SHA256 c5e6cd7138c1201d490d0793d67a89094a9319f45c486df741b4c6434549c160
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchML8RPSJC.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\searchML8RPSJC.htm
        • Size 140KB
        • SHA256 f9bfaf5f36830eb5ea3f5529eab75b26ca32f3d5bb53446c070cd192dd8e6f56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYRQ41TCH.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\searchYRQ41TCH.htm
        • Size 144KB
        • SHA256 86cd2e156d727788f9f699b4f6603fcc44a2cfbc0e4b7f38568a269ec064ac51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\search[4].htm
        • Size 143KB
        • SHA256 b05e9596268638b10e833122ee22cd9c1c35ceeba4ff40cada50bc03e877c0db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\search[5].htm
        • Size 115KB
        • SHA256 dd3e0819b961627b61cecca0c64198bd17bb80eb0331c177359d8f5482ced740
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\search[9].htm
        • Size 118KB
        • SHA256 38bae924487a8aec44c1e659a3d2b8a2106664f82073ee1dfcfbb83d6c764493
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp93F0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp93F0.tmp
        • Size 29KB
        • SHA256 b2bcf33c1b6889aad65cd32a2e54642866d03848ca0fcf2a4125d0ac52cf310c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 ea99f4955474d3d4d6999447adc839649cb1b3770b7a43b94e87fc3dd58bdd62
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 d13bbed37f222167e34ce16e143d158ec736e2ea954934c45523b525fceb787b
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 8c30dfdeda8509f033258e68066a350d71f8dbff126246c5f48496eca84c97b5
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 53d722e9e2c226e66bb0443f09ad8112855bacafb001b9a6ddef2e0ab4078da6
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 c68300e76b0e36527b7557da6a460d335ff2405bd66084543ecb8540dd541d48
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3752-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-38-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-179-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-258-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-359-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-256-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-263-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-598-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-505-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3752-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4860-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-504-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-597-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-37-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-255-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-178-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-358-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4860-262-0x0000000000500000-0x0000000000510200-memory.dmp
        Download