3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe
Size

41KB
MD5

494ff35437a3f21841cd52b32f10a33f
SHA1

4bda4e103c6f2bed8d1d0fa6ea5a7a1f8115a316
SHA256

3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69
SHA512

801733f6b7b9bf26520db498550aecfc3644740938b0a3d709ebda46976e93e8ad4dcb2000b623350ef27b3612ba7262ddd047d2aae596c30fc5189651becaf7
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1444 services.exe

pid	process
1444	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2184-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/1444-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-35-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp3F68.tmp	upx
behavioral2/memory/2184-105-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-106-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-219-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-220-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-224-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-225-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-227-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-240-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-241-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-252-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-253-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-254-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-255-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2184-371-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1444-372-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe

description	ioc	process
File created	C:\Windows\services.exe	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe
File opened for modification	C:\Windows\java.exe	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe
File created	C:\Windows\java.exe	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe

description	pid	process	target process
PID 2184 wrote to memory of 1444	2184	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe	services.exe
PID 2184 wrote to memory of 1444	2184	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe	services.exe
PID 2184 wrote to memory of 1444	2184	3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe
"C:\Users\Admin\AppData\Local\Temp\3bb1d01d8427944159d76d41d570e0a03ac939945b207cf23630e642b0b13e69.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\default[4].htm
Filesize
310B

MD5
2a8026547dafd0504845f41881ed3ab4

SHA1
bedb776ce5eb9d61e602562a926d0fe182d499db

SHA256
231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce

SHA512
1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\searchR5TBGDR0.htm
Filesize
148KB

MD5
5964b26ad6ccd6b15795b40a386eed64

SHA1
85922640c79e1fa53c90c9eace875915e592978f

SHA256
26d961263f77583a6320451e869375c8febff470ded88e7faec231aa49af3ecb

SHA512
0a84bb14113bf5e66dcd50a7ed48aae5fb0816017be32377860348fda6d9ba05a0fe27caca842b7a23bbd6bffe9f6e32791254771726882fddd56e5e5aa15728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[4].htm
Filesize
135KB

MD5
2f5258bb2d1cf146f94689e802f4e72c

SHA1
f65c33c866f2468a2fbbbb6a4186e79e1f9db8d8

SHA256
f8c27fc71d42a09e525851c44941ac36c44f5e3dad012d1f0f5785afd69924f4

SHA512
5da436aecd08b6428f2b5294757289edcb65549621176a9359e885d51bd9419568744bf4caf86b19f467b7bec9385dff5e2d63f0fc164a47d26b0a495b7b6e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[6].htm
Filesize
102KB

MD5
b2c5942737c03821ee7fc48b2a2a6003

SHA1
d7d9d6df712f9a00e506df97a1e613981a8a0f28

SHA256
0e6082eb1d69f57d78e143364edf65d90d63fc82794c0c33c08c6732b87891c3

SHA512
992d5b6494ce4c6384b28eb442fac8adefda7862bd7cf16bdd3704ae168513405664244fb32043468680b260767ca9f25b34e28497c60a1cc46309c1eb69ef09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\FDCPBF4V.htm
Filesize
185KB

MD5
14b971add79ef12dbe16fc32df1770c4

SHA1
6aaf0bfc83205c1f7b6536f63cf5f8db81bc994d

SHA256
fba2f020fde28ce68448a4d961eb88426e6445bdc6d9be310ce98c73edb8de1c

SHA512
8a34dded3f0b80be0af17e905735db593fd4f8cce3c305109563cdd6bf1352e2611f63d0cd392acdbf9d0830858946b6b1799000170c07ac6b7f10548c1ea386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\results[3].htm
Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\results[4].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[5].htm
Filesize
138KB

MD5
e744cdac3b83b2386aa5a89111f1ea86

SHA1
a817a935801d6efa9f11655c660bf572d052b4db

SHA256
94b06123c9fbe480baf55a3bc1b8a201750362a6323f36fcbb0af813b0205352

SHA512
f044dc73f690f1a04842fb3abbb15cd40b10c44014075d701a9cecc176483d33c9620144168bc42d93d570cdf25e2bd30da2c3baac2c236690eb3e8d9c186659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[3].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[9].htm
Filesize
136KB

MD5
1125d7464f3934c3216582a7fc836d56

SHA1
422068828de1e4a4dfb26acd78c8d6515a3b0bad

SHA256
59d6ff95ecda68e0e40c94de8dbeee3a9206bb32f0f41a9c4ff214b0db8e7150

SHA512
7a9820c789db59c2ea3bca093bc12a7e8f0317868a0fdcf9902385be406e95a1bd6ad403088e3327c76047586eacbbd3501e22f6096e2f2b7d8977369f55155c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3F68.tmp
Filesize
41KB

MD5
b4c3367e01207a6d40e969d55d52e910

SHA1
8f7fc2bb0ad88831429e92c64fbc92db6529379f

SHA256
a6c76a77d8f5b78024858a0240af081cdb39fb1ee9a14263c8a18930d2f177b8

SHA512
2b34fc215b5d7ec375c1a676647a84a8e8adec851221dc0599d05ad5aa1d646b7d5e28ded96e186fd30b0ed6c686a06a87379d922f66a287b5a5aec32e70d3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
17539ad0a758d88fdf5b78db150dc52b

SHA1
2cba21d46d57ec05d8c72a55b6beefa0098e062a

SHA256
4d18c14581af9b3b7d72c280dec5eb63e448302a72f309a259d6f943b0ea353b

SHA512
169b89c1b3a33e432e431db02c4dcfadf8bb8136ba36d76bf4724ec7cdd0159cdbafb8a29ab5285ff5e878e88864df69b8d2aff039e192317aa68071f3c8260b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
195b5239d082b93590b9f4c13b419fb7

SHA1
eb61256c0cdf2fb7eeefa5c0aa2f545c8f51cc31

SHA256
024810e18bc56698ed1efceaafa688f4800263ad511b9bcdd0a775366fce4774

SHA512
daf683e56085c50e8213897dc7b9bc04a94de4d481c8f5dbc8ebae24c5f3ab0ab521390beb4284bc741355aa1b0bb15067099d4cf6a189b152a58227de850717

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
3a26423b4c938e863f6deb60109be3f1

SHA1
60769e264d2d73200bd4e588d518b47a41ea2451

SHA256
259daaf812597c5d0debd3aa204c2f6112c17de4d2789ae1e06c29cf676fc8c1

SHA512
8b227209f100c51ce1750de9bab0dd15e788256b29ffa949959c840d4ea283c7e553652bebf028a1b6c2ab0b09b60c0405b282f5b815a7c153e9b7407881cd51

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1444-255-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-220-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-225-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-227-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-241-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-106-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-253-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-372-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-35-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-371-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-254-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-252-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-240-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-224-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-219-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-105-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download