5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe
Size

41KB
MD5

7663710774650c8ae458263c7daf2c7c
SHA1

3dd73b60c18641ac6c38e445d1fc2b48e9c7c23a
SHA256

5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170
SHA512

d5bd9f0289e7d9c3306bad4848e6f0db6e55c234cf13e242b9096d0affc7e21a779da65e9d1725e09194807aad55f93fd5b78e416ddb182dca868eb6235dd632
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1864 services.exe

pid	process
1864	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/548-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/1864-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1864-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1864-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpF7EB.tmp	upx
behavioral2/memory/1864-207-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-206-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-283-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1864-284-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1864-288-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe

description	ioc	process
File created	C:\Windows\services.exe	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe
File opened for modification	C:\Windows\java.exe	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe
File created	C:\Windows\java.exe	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe

description	pid	process	target process
PID 548 wrote to memory of 1864	548	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe	services.exe
PID 548 wrote to memory of 1864	548	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe	services.exe
PID 548 wrote to memory of 1864	548	5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe
"C:\Users\Admin\AppData\Local\Temp\5a6221ee78ac14560a68f8298f603b673369ca4f42e36471242ce718447fd170.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1864

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\S9DODI2W.htm
Filesize
185KB

MD5
453109eb3a222048babc9f00cf6f2d93

SHA1
175c9ded464839cd498861fd0f68257b04a236cb

SHA256
5c12cdcf7ce6f7ae09bc715a640c33dc10430ad46e134b4b46882d66a0ed6436

SHA512
e23a14068a82276fcc6961fdde5c6df824725cf6f32a1bc7a4ae639de5ab0b50a3fb1d8debb62e462b388cd9a955ed10e63e4ad3f48ca030a72f01d3593eec7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[5].htm
Filesize
166KB

MD5
7eba8f4fa0cf6efd878aa52696b341c4

SHA1
e6f0f4a8216110a934a4c8a151919017d7aa4140

SHA256
2b5b2c267ec70ee425b0b72f7f5cf31440fa3e1f809c26d3358185bdecc28a40

SHA512
f7f962a53ae06a34dc05e6826e6028a7d761ce9129965cbafcd6fe2fef3b1cc2e68ea992dd519d7e164b8439d8dbe5622fa6228051efa8295a8146c667cdbaa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[3].htm
Filesize
112KB

MD5
2b019bc371b5beeac6685548cc865cdd

SHA1
a5e924134cff1635a3b377dbe8b3c6dfa8dce549

SHA256
16d406368b9bed7f3fdb9c28495b462e63c9a9bb07e47681193abd9f6f32c866

SHA512
09b817237ce7b86a67f3ee05a28c99e2ae6cf196d4117f9beae45d281a7e0492e56b80c2a8aea6d06f147d038bf4416b657ad38aca6a5ddf160bb98ed7bff482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[3].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[4].htm
Filesize
138KB

MD5
92555b5a4d52dc0b12ace08a98354f1b

SHA1
f60500720adb5dacba717067761025d374726b05

SHA256
7db07c23e7059f19a202819e672e0ad056bd11a608685c1c835db8bcf79e43e5

SHA512
13f39c93b811d74d923b04c9cd2cef55ede38a922f9158503e8bda71bbe4f748a306fca849b4a6cf1ada99ea020d8c530f228d744a0117a0ab68b0432bc45ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF7EB.tmp
Filesize
41KB

MD5
78cbbe14fcfff9aa08964c2d20ec9c35

SHA1
0d80bc29ec61d8912301852e0d6089f3dffee931

SHA256
950265a0a56f9734f2e3be0e93617fdbccbf26f28b90d10a7ad771681e7895a7

SHA512
e2b78ac25d8c0ce9ae32ccc99c8f77a79b01d526dfd316964c9fb521b45d647e763f94da0136b8ac2475152314fe7b9c3483062c32186ebed21f8232a74886b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
4f1762f2aa902d8cfa34ec1d71e2b549

SHA1
583d6559b3f2e07518396284c0ee09e442e6e1af

SHA256
71dfbd78240c36dfd629d895bc8ab25ad087a7e73d1c1ee65d08c1f4bd1e0f16

SHA512
35c4b48d08b061d00a7bc83803be9c3b35403a94bc54c13048c39da95a37a3e04c0ea006bd28b9ca1781e462a179e2f27f077ee384f66121f9de4a54bff19053

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
ce6a3d3d3158ccfb3e400563c552f394

SHA1
3d0727f9014146f378547af58a6cd73668b27415

SHA256
0264166bf388e6e92c5589a3b68ba33b8b16d637f1f1ba9071e813df19164add

SHA512
c5540865101f01a971007d67ae230fcc9c5f2274b2299c3b6317ba1b831226ddec51c5e7a1a01f4a0f2bc706e823f0a5e8c83dabf3c1296738d4511f87fc254d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/548-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/548-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/548-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/548-206-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/548-283-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1864-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-207-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-284-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-288-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download