Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 01:16

General

  • Target

    5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe

  • Size

    41KB

  • MD5

    64276638075d3cab665966be7f366682

  • SHA1

    3fb9c599d5dc9188332b4a9c0f1262c07ee24699

  • SHA256

    5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a

  • SHA512

    1bbd7440a14f8651ef4433cdda3a48071024838688f8ff88a0688cf56f28854232446f655731a44d1f02f1e572697e132f06c92dfa170825433154042be02826

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
    "C:\Users\Admin\AppData\Local\Temp\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2088

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\default[1].htm

          Filesize

          304B

          MD5

          cde2c6ec81201bdd39579745c69d502f

          SHA1

          e025748a7d4361b2803140ed0f0abda1797f5388

          SHA256

          a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

          SHA512

          de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\default[2].htm

          Filesize

          312B

          MD5

          c15952329e9cd008b41f979b6c76b9a2

          SHA1

          53c58cc742b5a0273df8d01ba2779a979c1ff967

          SHA256

          5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

          SHA512

          6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\default[8].htm

          Filesize

          302B

          MD5

          769768a36c7e2fcb2db7f35ef986ce82

          SHA1

          0b6699476462d2139e553f0f78ff46890d37d336

          SHA256

          f262291ff7be8b0e2e846525c772c214799fc26b244abad6a686c7c4ff8cbba2

          SHA512

          2fa0310627270dac3f4e581bef0036743eed32403f913c833aeafdf7fac373ccfb0117cabd94725dfee672345ca3f46182377340e15e2fba38a874946683ee67

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\search[1].htm

          Filesize

          25B

          MD5

          8ba61a16b71609a08bfa35bc213fce49

          SHA1

          8374dddcc6b2ede14b0ea00a5870a11b57ced33f

          SHA256

          6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

          SHA512

          5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J9NDGDSC\default[3].htm

          Filesize

          315B

          MD5

          14b82aec966e8e370a28053db081f4e9

          SHA1

          a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

          SHA256

          202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

          SHA512

          ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z5ILU938\default[2].htm

          Filesize

          304B

          MD5

          267ddfdbb8d492b25de208d84b290f1c

          SHA1

          9f57d9f19f25549e1232489a0c101a92e851de2f

          SHA256

          ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586

          SHA512

          0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

        • C:\Users\Admin\AppData\Local\Temp\tmp1366.tmp

          Filesize

          41KB

          MD5

          53327d2edc129ab76543e172b95a1a0b

          SHA1

          6683f88d2589789bf097c74007ac9a3d253a753e

          SHA256

          01cf1df420b041adb02011157182a9bc942fb10a50f240f8ef085ad3b14494a7

          SHA512

          824e2138ee5e23e307b3af2f99daf09fc472e94df7ce224819432625aa404d3f46fca76fd70c7512c712d790fbfb2cccaa47e5f0a7d1c8d5ba79f6d5139ec618

        • C:\Users\Admin\AppData\Local\Temp\zincite.log

          Filesize

          160B

          MD5

          b0f7488c7dbc1fa1eb76b92bfd98b200

          SHA1

          2b6cb1475cdf6401a1cc5f24450c0267814ed33f

          SHA256

          4ccad79fe4d466efd3523497f7e501f36f37b69f3bc8ed66842f3b4754d5ac02

          SHA512

          70653f343fdafbaf7dd79222120066373b82a7f9432294cf4f4f519c2ca0b9701578b6eb37bac25b8f2cdb082e5e7a4bda4024f2b92e5cc4196c19cc9b4b595b

        • C:\Users\Admin\AppData\Local\Temp\zincite.log

          Filesize

          160B

          MD5

          6c784b9e0158bbf82e919d1532c4be49

          SHA1

          7614c1ace929b2bb04c17b65eabc96290fc4efff

          SHA256

          5ade3c8af2dfe244620ed27b28362d65052604071fd786a0ed95e331d9d05546

          SHA512

          3685850eb5cb79a82d674ce0cae1360e029bcfafc5164ea62454efd83b63929ab832b369c12634a51931ebbfb5c9ad329365f9cd48b19ede22a031bfff029486

        • C:\Users\Admin\AppData\Local\Temp\zincite.log

          Filesize

          160B

          MD5

          b2737f35d3f20b384218771b8a06fc58

          SHA1

          2da73074934bc301cf4a52d1ebbd4e664f4022aa

          SHA256

          796a9f4042f14a46aee7bd6335e0ecf08711db9c8a0faf9faa2acf8efccd6693

          SHA512

          dbdcfa96c31bbae4a8a849035667cf43bc4e992d0d02a2651210c9beb8f854778433de7baa7e0f0336b64278f65c3a7e7ae51f5a6ab7fde00e65109dfbb0ac06

        • C:\Windows\services.exe

          Filesize

          8KB

          MD5

          b0fe74719b1b647e2056641931907f4a

          SHA1

          e858c206d2d1542a79936cb00d85da853bfc95e2

          SHA256

          bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

          SHA512

          9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

        • memory/636-307-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-98-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-240-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-30-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-13-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-150-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-0-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-154-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-201-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-270-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/636-161-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2088-151-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-162-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-160-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-155-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-202-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-99-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-241-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-31-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-26-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-24-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-271-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-19-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-14-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-308-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2088-7-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB