Overview

overview

10

Static

static

7

057202370c...4f.exe

windows7-x64

7

057202370c...4f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 20:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    057202370c33582f5f4d1730afd3fa146dfc55a4fe083435b54f3a19604b534f.exe
  • Size 41KB
  • Sample240703-zaangsxgrb
  • SHA256 057202370c33582f5f4d1730afd3fa146dfc55a4fe083435b54f3a19604b534f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\057202370c33582f5f4d1730afd3fa146dfc55a4fe083435b54f3a19604b534f.exe
    "C:\Users\Admin\AppData\Local\Temp\057202370c33582f5f4d1730afd3fa146dfc55a4fe083435b54f3a19604b534f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2396

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QNB8LEL2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\QNB8LEL2.htm
        • Size 175KB
        • SHA256 20ca0cf9941e1e8cc8e4032e12f362bbbf09c49576b5779cd3670704f9fe65d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search21UXJFYF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search21UXJFYF.htm
        • Size 133KB
        • SHA256 76b4dcb81fae1eadf495ee1ece1cea1349ff2cd8b69b9c1b356d569ccce37707
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search7YHKQIC7.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search7YHKQIC7.htm
        • Size 129KB
        • SHA256 87a576242c15793141984c6581d8a89fa6a25bdd5ae810b6de2614fcb5518668
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchIPF0O41S.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\searchIPF0O41S.htm
        • Size 123KB
        • SHA256 fa6be25872ada715b22bba8ff0e42c1379b33014b9ee35a43d32ed43ec0ea8d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchVMO3KPR6.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\searchVMO3KPR6.htm
        • Size 104KB
        • SHA256 3f0464ef987f01cd9a5cc0a6f093a7b27d41f1ceae7fb32ddcf6921ce120883f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search[1].htm
        • Size 124KB
        • SHA256 adeb39b3fd2b47361a26550980ead08d1d50b6cd1b97f9a2b1c9e63a26971c9b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search[3].htm
        • Size 106KB
        • SHA256 3d32cd249d9cee8b4e2868c2f24977f14d0e4d389a6b4ddacb0aa08e99429b60
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search[6].htm
        • Size 172KB
        • SHA256 12199e316e7aaf4c2f9c4883fce3862fb344b0b74868dfa06040e564150984c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\default[4].htm
        • Size 309B
        • SHA256 bdb7ac94dc916af2d7784a5c147167ce13e49d12baa9b8f3cccaf33e29419a7c
        • MD5 SHA1 SHA512
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\results[2].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search3W4FSRF3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search3W4FSRF3.htm
        • Size 167KB
        • SHA256 23b57ff4c0a5d52946ceff0f3865ab17b64441d869fd1cff6051bb79cc554e88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchIGSPL24D.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchIGSPL24D.htm
        • Size 125KB
        • SHA256 444eb9e9074cb5a6323d61ddb4e2f844d551ba76a3535d68faea5d2234fc99a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchNLSWNPN2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchNLSWNPN2.htm
        • Size 156KB
        • SHA256 7e92aed4a01abe02d40e145ad94e81365be0ac7b1025a48e81b21f9b83ba0ce0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRDSA2WNX.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchRDSA2WNX.htm
        • Size 150KB
        • SHA256 b006cf73de74a9d26a2f0d8b3cae3130b9f54a2f6f40271a5decedefb882ee43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYL81ZQBN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchYL81ZQBN.htm
        • Size 103KB
        • SHA256 7c90ca432cf3d26b484c484cb2c76ea1c4ce2e32e3d47b763e1610a78e55cc45
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYSVIF7C9.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchYSVIF7C9.htm
        • Size 137KB
        • SHA256 1efa5764aec5bc510f5ab9bc63c59c294450bb0deb00ac9fb7275e12e49131bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search[10].htm
        • Size 138KB
        • SHA256 279904eaa89eefdb186093f80a7581aff6d46176bce76debec53e3851f252eb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search[3].htm
        • Size 143KB
        • SHA256 463ae56d67294fe213520606d9e42655f7416d0964dfe15441253fb8f273e431
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search[6].htm
        • Size 122KB
        • SHA256 cf243f0869b87c6371d3d829efc75e18419a6466055c5e511a70a73fba274357
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        search041I03EI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search041I03EI.htm
        • Size 138KB
        • SHA256 5703838f59beafdfaacc2ee4037f599cc61036c587d3b42c62e2b0d046c40f45
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchUP6Q6YRG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\searchUP6Q6YRG.htm
        • Size 132KB
        • SHA256 998761a8ed0e0a2ef9f241b7d85b2a799557d7dc09ea3a2f853bc0c68e8427e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchV8FL55ZJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\searchV8FL55ZJ.htm
        • Size 127KB
        • SHA256 0d2a35f7de2821c30676d2c9cea98e202a6069e109821098e0d1b81dddd5a8c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYBFKNB8B.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\searchYBFKNB8B.htm
        • Size 151KB
        • SHA256 2fbb135ccaa016a54d2908c6fdf9e81d0f42a16360913fab6450e5817678a402
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search[4].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search2G8UK0IQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\search2G8UK0IQ.htm
        • Size 118KB
        • SHA256 41bfbae1f1bbbe70eac19fbcbeab98a827c343e0307c2b3f3674434ddc6c4924
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search7VVTAYP2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\search7VVTAYP2.htm
        • Size 136KB
        • SHA256 ce348bf173ffdf0b0dbdb4b2bf0f0b38cfca3df945f1445d984372cdf9f1223b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchCF6TSQFF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchCF6TSQFF.htm
        • Size 143KB
        • SHA256 a03f926c658274c1d01cf9e5d4ab3edd54e685e62d90d60c105c1999656eafb4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGRIUI4VT.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchGRIUI4VT.htm
        • Size 172KB
        • SHA256 94e352b7ae566961912bb376ce60b705bea42f655edc99496a825eb748ea3954
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSIROHBCS.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchSIROHBCS.htm
        • Size 121KB
        • SHA256 2a13baaa8f4457b1f979516838cd1a6509eb36a3db44bff369a3e168fe91042f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchWS7ODVO2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchWS7ODVO2.htm
        • Size 148KB
        • SHA256 6c680499dfa6a5fca7169de2e5849a6b319db0611cc6bc92da4efc32edd072e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYL6Q107J.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchYL6Q107J.htm
        • Size 131KB
        • SHA256 df90ad1b8c32d705eaa91d448124db79054dbc85e56dabcc067d2d58e871bcb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\search[7].htm
        • Size 114KB
        • SHA256 56c71924d4969f7818df20cd4c5075fce909fdb7363f1120293588195f65db50
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmpF85C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpF85C.tmp
        • Size 41KB
        • SHA256 5873d53e15aa89479fcaabc9248975c1b0aa4774e6b5809cb246e5ac66e64c7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uCu4vn.log
        • Path C:\Users\Admin\AppData\Local\Temp\uCu4vn.log
        • Size 128B
        • SHA256 3e476d3e5b212bba3aefc69853025d6f9b580d47fd6b5cf2e8ee65f27b631781
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 1ed2ad9d1335a9123e6fd8a07e94e4b9b6208c7bef132f0787451b4a4b79f846
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 1bde638824754e91e61079dc9a9af7a6e91b1382a172fc41ac4af65e3cc2b167
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 716e9e69d0db1e9ed82b8f8c7165034a9981af87ea43aef18873b2cfdc354dec
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 5350930ac882f7c46fe359abb9214a8cb8cee9d544ffa3ba0274579199e90a9a
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1348-647-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-161-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-1218-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-468-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-25-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-857-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-246-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-1024-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-311-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-253-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1348-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2396-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-1025-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-858-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-254-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-648-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-162-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-247-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-469-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-1219-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-5-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-249-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2396-312-0x0000000000400000-0x0000000000408000-memory.dmp
        Download