Overview

overview

10

Static

static

7

73cf17ff6a...0d.exe

windows7-x64

7

73cf17ff6a...0d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 23:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    73cf17ff6a9b50041790b35adb88b71a40c8107497eeadeaf2e13a31ff06050d.exe
  • Size 29KB
  • Sample240703-3bz7batalf
  • SHA256 73cf17ff6a9b50041790b35adb88b71a40c8107497eeadeaf2e13a31ff06050d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73cf17ff6a9b50041790b35adb88b71a40c8107497eeadeaf2e13a31ff06050d.exe
    "C:\Users\Admin\AppData\Local\Temp\73cf17ff6a9b50041790b35adb88b71a40c8107497eeadeaf2e13a31ff06050d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\default[1].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        search28SPLPLL.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search28SPLPLL.htm
        • Size 190KB
        • SHA256 87696ee24344061ffe471b3ffa1616680584752abd77a93bd326b8a4553193c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchHC9CSQW5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\searchHC9CSQW5.htm
        • Size 113KB
        • SHA256 da96944f9d91d9f4c9a1a26c8786d89f2f9826073f3e5f994cf35355024651f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[10].htm
        • Size 137KB
        • SHA256 6fde4ff28956551d86da19f961815d10ccd27903900b721685198e517e6c10c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[9].htm
        • Size 120KB
        • SHA256 72f95b737ec4d9f89c6c0d18db9c494b61e7baf51a01a4d72102cb7e8ce44301
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\results[2].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search163AYBYK.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search163AYBYK.htm
        • Size 149KB
        • SHA256 34f1d85dfecb144e6dd9b4f72b5efe079e75c140d5b15df878cc9d6317f6a286
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchM0FP6WQ8.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\searchM0FP6WQ8.htm
        • Size 163KB
        • SHA256 dbde8c8ded41b51222f757c01e01e3c3924c360666962a5c890db22f2cf00bd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSJOCVMWQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\searchSJOCVMWQ.htm
        • Size 116KB
        • SHA256 f0946bd75eaf2b0b21f7211a0ff426a54d59a5e978a933ffd853c20b80124e16
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZQ7B2F2Z.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\searchZQ7B2F2Z.htm
        • Size 141KB
        • SHA256 b57c61a9f0aeda1efb4fe3e36320cf82679f4a055a04af7d6e657eb0af7239ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search[4].htm
        • Size 129KB
        • SHA256 e941d8fe2e4d7d2802ef2a420d31303b50cc2a1b1fbd535e92d0d4338e840272
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search[6].htm
        • Size 130KB
        • SHA256 aa3a958bb19c666d068fb6238a7b282549a50af2278d798f874e10baa12b583b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search[8].htm
        • Size 209KB
        • SHA256 b8864c88e68aa0198ac06b4a0f90931b5b0104a6029a00c7faae9c81066e391a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\search[10].htm
        • Size 130KB
        • SHA256 955eed1a8a07d1f04bc65a621ffacf456b527255fc0411f274015aa4b9172fb0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YDJBEYL2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\YDJBEYL2.htm
        • Size 175KB
        • SHA256 72101960e00177b5eb154d5d60ef501d699fb63fccc2f84200dd476a8d7bb094
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\results[1].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search1435YDC5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search1435YDC5.htm
        • Size 123KB
        • SHA256 8bb508778bd20bc5209c0fbea88605a0180ad4cafdfe13a6cfe1086759c0fdec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRIMRQJVX.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\searchRIMRQJVX.htm
        • Size 150KB
        • SHA256 e9b0943df46dd0809cd6db301c54e881368dedc9b60a6525cdb4a766c0b202db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[3].htm
        • Size 125KB
        • SHA256 10547cc96cc744c5336476a8f5e060a1e7f78e1c16f11bf9347988f5b4e7e4b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[8].htm
        • Size 160KB
        • SHA256 423b5ad02d6073893f262ad9cff3eecacd722ceccb1f57f80fd9f86b47776eb8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp23C2.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp23C2.tmp
        • Size 29KB
        • SHA256 d5920015bcff6e5c1bb6cdff64957f9548cc7ed9df4459161bfe9b1939addff7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 c369bbe88fd0ffeac0ba998de3e637af7785eb0d29bcf74ac18eed9a5b9777f3
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 b53e67b4fddd20174df91c55119bf0e7cdb40baeff453e5d958ab3f707d57a3e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 91145c3f588797b9b9f88fd221e6b26609282fb37c8a0238301f9903b7e850b1
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4708-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-149-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-725-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-720-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-369-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-718-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-655-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-320-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-512-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-313-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4708-315-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4948-25-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-654-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-314-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-511-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-312-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-717-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-368-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-724-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4948-148-0x0000000000500000-0x0000000000510200-memory.dmp
        Download