195688fdc5454fb7f6ba8188015e395bfe86876a9c0e28b818944ee264f0e77c

Resubmissions

21-08-2024 19:30

240821-x76q3sweqg 10

21-08-2024 17:42

240821-v92h2avgpj 10

12-06-2024 16:01

240612-tgps4a1bqh 10

Analysis

max time kernel
60s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
12-06-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
Size

41KB
MD5

c89cb72586afe2f652ccea009225cec6
SHA1

89617d49fe5366b120d6fe9fa098bca7d3b5e1ad
SHA256

e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02
SHA512

dd53d4e714d1f39300a5ac0988877c857546a1f4117bb06e2cd0db567ad8949be1dc4f7fb7ec83e077f546501b72715c8a92af70be89c7c5e30102b6413f6f31
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2180 services.exe

pid	process
2180	services.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral30/memory/3308-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral30/memory/2180-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral30/memory/3308-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral30/memory/2180-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral30/memory/2180-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral30/memory/2180-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral30/memory/3308-23-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral30/memory/3308-25-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral30/memory/2180-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp1F0C.tmp	upx
behavioral30/memory/3308-207-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral30/memory/2180-208-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe

description	ioc	process
File created	C:\Windows\services.exe	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
File opened for modification	C:\Windows\java.exe	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
File created	C:\Windows\java.exe	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe

description	pid	process	target process
PID 3308 wrote to memory of 2180	3308	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe	services.exe
PID 3308 wrote to memory of 2180	3308	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe	services.exe
PID 3308 wrote to memory of 2180	3308	e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
"C:\Users\Admin\AppData\Local\Temp\e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\21CR7UOX\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NDYWT7Z5\1M2OM5VC.htm

Filesize
185KB

MD5
e8d8b458654746ed11e83e558b6493e4

SHA1
1c9fe728b25c966858198e5927b862847d945152

SHA256
c10ddcc10b52765c1a6011deaba45394e25ebfe40b74246781e96cfc326c044a

SHA512
5083c4eca05c2013599866201e5978d71effba52980e6cf00bc3b5ca3dfc6aa39aea5c59ef89450ab623c19890ef664d552f7932e2eddd3fa5055ae5be18ad97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NDYWT7Z5\search[2].htm

Filesize
149KB

MD5
08b3049a0377836e4a831e4d9ca47383

SHA1
6bab44d880f624cb9ddb2ca5071d9561d2610c94

SHA256
d1b058baf11cc26858bdf6b77ea0a52a101bcfbc569610693ae74da48ad448aa

SHA512
f5e019df9b71a6d0815c28f72f1582bb922643ca09c4f3f7262563613bec58528868eb4c47529337bb4caf29f7f569d9865c48423dca9097f05330a41ea3079e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RJFWFK7E\results[4].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RJFWFK7E\search[6].htm

Filesize
154KB

MD5
855a43a2e10d6aad9415b3f176efb2e3

SHA1
270bf07d885ff09a01338bbfbc54245ac6cce2a0

SHA256
31bfd49545665e8a7f92a228422444e9abe141db20ae0c956de62fd809d1c169

SHA512
c6e4cd99626bf603c092dcbf21f5ca9bf2bd7d55ae2e1e60246a7dfb2e8d6394bd380f553eef54729f65f22f2d7b5307b0b570a118ed496361526b57d8082d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F0C.tmp

Filesize
41KB

MD5
b3c9d8a1bbf1986399b6b87db7673d5a

SHA1
362e51856646fc773df9842711261d6fde6001cc

SHA256
d7bc29a90d2ed441f5a60728bfdcd3515e06556c235c4f47d0c17c560e8c4daf

SHA512
4bacfef3fa5b55e4c7965d13bf99c4ca0b35315edfaee6b89b5724503bca5f8127c1ebb623424b28af219f461bc4376e9d9f8c0d09ff9cd6560a3cb9d79378ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
128B

MD5
c807d7e05fcefe0f982009674a7ef163

SHA1
2333b570f1257987cc40b02364b20ec9053c9852

SHA256
fb4015f78f0d7ac3165317fbf784095ecee2ed38fdb1f280fcb62e411b3965fe

SHA512
26eebb871f439220dfb92d58382345224ccc65ac997d6e21ed2032ba027d7053dff22257bf7f06e66423bcb9ad86a3ed663ff94c906a52d83a0fb5e67f2a2882

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
128B

MD5
a9a0e02f6f259dcd3c18cb89ce8d555d

SHA1
05d5def9dd5d06b115eb1cb072795a8b039aa504

SHA256
0435a0d71ed0f877797e846143aa7d6575ca12b4aef79894881fabbdb06d11cc

SHA512
6f08987b91db7fcf5f7996c7372a9bcf2b28c1e5ba37c5f38a9722e7813e37926bed202760110c5136275ec131b58cc2ea2a7b9f36d81affe55a33fe874ffc58

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2180-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2180-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2180-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2180-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2180-208-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2180-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3308-25-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3308-23-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3308-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3308-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3308-207-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download