dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
Size

29KB
MD5

5eacd392fdcb1f3e98bbaf113bf8bfaf
SHA1

c38a26c091180acad3dddff9c9e9bb6361a423b6
SHA256

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8
SHA512

59c203f8e3047f853ed72f4f6ddd5dc48fe38b8b1f796900842493eebc69e381488cad3ed4d7ac7b293510376166e7cb732ac3a96f0dfacbcad80ef19fe5637c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/+:AEwVs+0jNDY1qi/q2

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

760 services.exe

pid	process
760	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4048-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/760-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4048-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/760-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4048-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4048-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp8AF0.tmp	upx
behavioral2/memory/4048-151-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-190-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4048-301-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-313-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4048-316-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/760-317-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

description	ioc	process
File created	C:\Windows\services.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
File opened for modification	C:\Windows\java.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
File created	C:\Windows\java.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

description	pid	process	target process
PID 4048 wrote to memory of 760	4048	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe
PID 4048 wrote to memory of 760	4048	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe
PID 4048 wrote to memory of 760	4048	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
"C:\Users\Admin\AppData\Local\Temp\dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\HY2SHX5I.htm
Filesize
185KB

MD5
a7d0af45ee5000f50ec9c05b2d37e4be

SHA1
e4e74bf4eca541d8baedbfa4de1f1e0fa8a4eb13

SHA256
4eb49b13edefaad3c67e8518ff539bc7f7e1964ce3405216480e94e9908506fa

SHA512
7ce1866a4c950fd83b6d830b2227bbd95a5bf2ff77df7d841819f286e7f6b22d20f8f7292660c06339e5659b5104d39e054da0538ff6e1fe9adc91d63d80e955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[4].htm
Filesize
131KB

MD5
c8021a05b4f7775352a60535a59a4d41

SHA1
f25386fa4c5064c8404b73636702846acd11dba4

SHA256
daac2872c304827a84e3b8405f6294141ecfc13cfbfdc4435674f9b1ea806f81

SHA512
81850cbf925e0e538f4a23b946cc50d028f39797ed65a876fa6605689022464683fe514d385fb25a2a046715910ce71b130f0825b21069371ac8513016157c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[7].htm
Filesize
128KB

MD5
4b2c86d7a04bf0bf21ce57810f4c8500

SHA1
871af29f389d57c68f2a8b122d8694d0206d9051

SHA256
cc0284964f0f406e63130334bf8ceebb35edd79d4cde6d1315bfb5e4105444d1

SHA512
d1a0fd5d60f648f98210645141a908f181263a4d12ebf6b86285e401e7cffb6fb0e110e5009004b41ea15056e45f3a92af4416739ab61d4f8bb858a206ce7534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\DZVDRHJ4.htm
Filesize
185KB

MD5
f62b80debc4b5ba2eee50cb2d7aa98e3

SHA1
c2d3bcf19fc174e5b755a95ffd8a2eb30acb035a

SHA256
4789b644452c089ae40b3d7afa87f9c089b55439f53483cd32f03f9fa94f77d6

SHA512
e67a955d54283602405c08bc5820bbca9aa003b66e58934e83cb7d2dca1cb497c3d264bead65c8693d89a84f1262e7a40f8a32e07046f134c35b20a12b47da19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\results[1].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[3].htm
Filesize
112KB

MD5
d5be3ad2a59255500283d4dad3be0c04

SHA1
7c21175a7083ad2585960d4018a00e4a4855c332

SHA256
0059342dbaa9a08daaac9b39cf19d29099234e727d5a0fe562fa49b373d05797

SHA512
86515d69fb439ea8642afd4130b40dfa097d5cfb9ba33d871f10decbd3b5ab8e173f1c3cf71a2eadcb59727e1776f4e8feaea23c0f2aaf745be5a2e8f41adc9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[4].htm
Filesize
130KB

MD5
c99baa0d8fcbb3c3110d353d845ddfeb

SHA1
f98c597b1ebad8038ece7ef1e8d31f8d7c80cb07

SHA256
4812d74720e9b6a77a981377156078cda8ef4d9394d31652edffb65895350bdf

SHA512
87cfa9bdfa9701086b08762b1316f60d5b8c6f6f94a6039d18feb780475ff1b8f25064833b1d8a11aa92a4b60957748be17174a8bfbbe48ecda68f6143247c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[3].htm
Filesize
134KB

MD5
5deffa3c7aeac01f2004429b31d94d46

SHA1
5cea42ff7a8222f9a2035e3cb7f79b23910a65df

SHA256
a9081acd445af7c5d69268accd41b1ffd86114ddcf5868f8b75714aa932412ac

SHA512
d21c34dbf7484cb9ef0495452f19e4336175b784baa0182a3e4367e196b58f468252289f5c853e89b50f39c1989277a71531f8c6a49a1ae1973153ad8b31ae1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8AF0.tmp
Filesize
29KB

MD5
38eddb8f2f847a7d0a96bb48bc6a7a16

SHA1
cd20630cb8ffdff291cbce4b413ed5b10a5c0f9f

SHA256
843330bfe7485a0bba5ee26888553363eea733b8e5240f19e9b87b308217aa43

SHA512
59e24a1afc1551aeca236fd172af70331cbeb289fb0b2b12518d4f2989bf588c8c19f2a35cc1e161a2b0db838f72ba6281ca1ea2c34b0688671e2fcbdc5dda7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
3f8d5e471f5705d9568818eab3e670c4

SHA1
fd9821990cfc2e20fc44e27e68cbf0747470353e

SHA256
2c86d808412bc621025da5e5f475549f1017be4a5c3db99ada8c675af5be4cef

SHA512
8faf92de13c33a63999214910d326a536b55c03b422917343aa24589664426468432c8ab4eeb9507b92be68f9f06d9c64e0fd3b66ba38564017ca3b4079c783a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
f32dbbcc4c1c5e523bd16c58de96ff95

SHA1
49a9d8c8c2b04834fec6304fd9f553f268b7518e

SHA256
4f2c0693e7c98f062baad1109cc288b736427ef9d6dcb9e1befb5cea39f8508c

SHA512
7a61df8cc019b426af272246c165ad9f3f43f48e2022406e6fcaf554103e57f7b225429939c70179e05d97518cbc77c891de94e7716822e45a098b4bfcc557a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/760-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-190-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-313-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-317-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/760-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4048-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-301-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-151-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-316-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4048-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download