Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 01:16
Behavioral task
behavioral1
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win10v2004-20240426-en
General
-
Target
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
-
Size
41KB
-
MD5
64276638075d3cab665966be7f366682
-
SHA1
3fb9c599d5dc9188332b4a9c0f1262c07ee24699
-
SHA256
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a
-
SHA512
1bbd7440a14f8651ef4433cdda3a48071024838688f8ff88a0688cf56f28854232446f655731a44d1f02f1e572697e132f06c92dfa170825433154042be02826
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2088 services.exe -
resource yara_rule behavioral2/memory/636-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x0008000000023413-4.dat upx behavioral2/memory/2088-7-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-14-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2088-19-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2088-24-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2088-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-30-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x000900000002342a-41.dat upx behavioral2/memory/636-98-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-99-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-150-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-151-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-154-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-155-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2088-160-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-161-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-162-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-201-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-202-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-240-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-241-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-270-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-271-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/636-307-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2088-308-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe File opened for modification C:\Windows\java.exe 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe File created C:\Windows\java.exe 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 2088 636 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe 81 PID 636 wrote to memory of 2088 636 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe 81 PID 636 wrote to memory of 2088 636 5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe"C:\Users\Admin\AppData\Local\Temp\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304B
MD5cde2c6ec81201bdd39579745c69d502f
SHA1e025748a7d4361b2803140ed0f0abda1797f5388
SHA256a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
302B
MD5769768a36c7e2fcb2db7f35ef986ce82
SHA10b6699476462d2139e553f0f78ff46890d37d336
SHA256f262291ff7be8b0e2e846525c772c214799fc26b244abad6a686c7c4ff8cbba2
SHA5122fa0310627270dac3f4e581bef0036743eed32403f913c833aeafdf7fac373ccfb0117cabd94725dfee672345ca3f46182377340e15e2fba38a874946683ee67
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
315B
MD514b82aec966e8e370a28053db081f4e9
SHA1a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7
-
Filesize
304B
MD5267ddfdbb8d492b25de208d84b290f1c
SHA19f57d9f19f25549e1232489a0c101a92e851de2f
SHA256ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA5120709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3
-
Filesize
41KB
MD553327d2edc129ab76543e172b95a1a0b
SHA16683f88d2589789bf097c74007ac9a3d253a753e
SHA25601cf1df420b041adb02011157182a9bc942fb10a50f240f8ef085ad3b14494a7
SHA512824e2138ee5e23e307b3af2f99daf09fc472e94df7ce224819432625aa404d3f46fca76fd70c7512c712d790fbfb2cccaa47e5f0a7d1c8d5ba79f6d5139ec618
-
Filesize
160B
MD5b0f7488c7dbc1fa1eb76b92bfd98b200
SHA12b6cb1475cdf6401a1cc5f24450c0267814ed33f
SHA2564ccad79fe4d466efd3523497f7e501f36f37b69f3bc8ed66842f3b4754d5ac02
SHA51270653f343fdafbaf7dd79222120066373b82a7f9432294cf4f4f519c2ca0b9701578b6eb37bac25b8f2cdb082e5e7a4bda4024f2b92e5cc4196c19cc9b4b595b
-
Filesize
160B
MD56c784b9e0158bbf82e919d1532c4be49
SHA17614c1ace929b2bb04c17b65eabc96290fc4efff
SHA2565ade3c8af2dfe244620ed27b28362d65052604071fd786a0ed95e331d9d05546
SHA5123685850eb5cb79a82d674ce0cae1360e029bcfafc5164ea62454efd83b63929ab832b369c12634a51931ebbfb5c9ad329365f9cd48b19ede22a031bfff029486
-
Filesize
160B
MD5b2737f35d3f20b384218771b8a06fc58
SHA12da73074934bc301cf4a52d1ebbd4e664f4022aa
SHA256796a9f4042f14a46aee7bd6335e0ecf08711db9c8a0faf9faa2acf8efccd6693
SHA512dbdcfa96c31bbae4a8a849035667cf43bc4e992d0d02a2651210c9beb8f854778433de7baa7e0f0336b64278f65c3a7e7ae51f5a6ab7fde00e65109dfbb0ac06
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2