Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 23:24

General

  • Target

    7aaa0d9cebdc799190179a62c5570380663642edc830d4c6d666565ca1b3811e.exe

  • Size

    41KB

  • MD5

    487711707577e62f22fba1bd43464051

  • SHA1

    3593355cc65971ff21ba61df386358ec7bc83027

  • SHA256

    7aaa0d9cebdc799190179a62c5570380663642edc830d4c6d666565ca1b3811e

  • SHA512

    d35db34ad357e0b662bfe12fafe8f2ee83fb9092d799d9e6c87aecfd5d7c905dbd096deb7de58598e6c67dad415196622a9092a6fb24844800823d079eeabb19

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7aaa0d9cebdc799190179a62c5570380663642edc830d4c6d666565ca1b3811e.exe
    "C:\Users\Admin\AppData\Local\Temp\7aaa0d9cebdc799190179a62c5570380663642edc830d4c6d666565ca1b3811e.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp525F.tmp

    Filesize

    41KB

    MD5

    26ab28bdc2d6c9232718e054234e583a

    SHA1

    37dc097d262c6e409f57815ee90e86c394e93bb7

    SHA256

    a107b8c3112351377b47d87ac56b6ec36ea55cc4871d180a1d02b1c0c74087bf

    SHA512

    e0bca0f0f4c4799c521f588d77f765a938c492c4b6b38fd864f659ba08c1fff4234bcb4ba7beeaba855ce607206528ede96ec892c45188cb662dc6eb3c8d50f8

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    160B

    MD5

    49788693ef8353752283fc1b797f0f74

    SHA1

    87e5545b7b940eb5406ddbe7ad56c3e0ac098501

    SHA256

    fe393f9f827732ac6c3382b9d7b9433a5454ea51013cae415095db52780ab14e

    SHA512

    04edb62ae016bf99574956dbb347952fcebb1bd9e2fce35bcc131dfb75e976d5551d9d6e33d5a99ef21d7499be1403f5c8735b7273e9c207c53e22ae788401d0

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2144-42-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-88-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-61-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-54-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-35-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-47-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2144-37-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3016-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-48-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-14-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-7-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3016-89-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB