31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe
Size 29KB
Sample240704-c4eg7ssbkg
SHA256 31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2
MD5 0ccbba8fc8a3c55d0c45f46dd6d52e70
SHA1 edfd25a401af26529da47fb57308e283d1e976c1
SHA512 a8762e1951b2bf9a8637fde9636883ecf798585580899cfbfffb52d3190ad6fbce4e636a726292f07f2ba7aa8344f8fefca84d876b6dd851cd2ac11b74142e8f
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/U:AEwVs+0jNDY1qi/q8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
2292	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1276-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x00070000000235a6-4.dat	upx
behavioral2/memory/2292-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1276-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1276-47-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c0000000235d7-58.dat	upx
behavioral2/memory/1276-87-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-88-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1276-233-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-237-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1276-292-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-293-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2292-295-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1276-299-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2292-300-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe
File opened for modification	C:\Windows\java.exe	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe
File created	C:\Windows\java.exe	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2292	1276	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe	90
PID 1276 wrote to memory of 2292	1276	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe	90
PID 1276 wrote to memory of 2292	1276	31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe	90

C:\Users\Admin\AppData\Local\Temp\31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe
"C:\Users\Admin\AppData\Local\Temp\31111115c2773fba3dc0434c0acefb27bb5c5a288605327ee9321c681cf7ccc2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3044,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RJD8XSNJ.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\RJD8XSNJ.htm
Size 175KB
SHA256 2444c694e2040600ddec0beefbf5b250c12a31332eeda916745e86a33d9b49dd
MD5 e6ea99e42fd2a27f21fe310153a309bf
SHA1 9776d66c74585a97b26f0be63146365bc31fdf5b
SHA512 40f9dfe5b53448afb678e25a976a15940178624905ada2f5c7efa6e6888092cd51d93d1ee2861b949c324850948c65887c2bf06970f968a47952a6f90f24809a
SSDEEP 3072:+UIeGAzVCbS0ZK+QG58TJLWIetIe5cwJT:+pAES0ZK+Q2cy
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\search[5].htm
Size 138KB
SHA256 0c7cff7a141f8fe22cbe00d5ad334fcbf6284d79b60a2e7a87d15fd955ecd645
MD5 49a673f41712320816741506f603e267
SHA1 6a9933092d206e35477fc78bacf175ac296d1188
SHA512 f207261fc3519f23007d15f9237dc2f4ee59001c398aa3937a64f0754e460fb60569e38e448aa4ca87c2621596036b897730120a7e19934ce5238570d5500edd
SSDEEP 3072:UWIeQuEFK5pmCgNDQYaDLb46raFB9xKqtP0ewTrItL8x8U8L8c8rpubFZ:UPPF5gOBQ5NuRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

default[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\default[3].htm
Size 312B
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
MD5 SHA1 SHA512

Submit Download

results[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\results[1].htm
Size 1KB
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
MD5 SHA1 SHA512

Submit Download

results[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\results[4].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\search[2].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\search[4].htm
Size 114KB
SHA256 d18cafbe607cc2bc8d3490f7927129b4908864eb06a10ffa8d7bafb5c7ae8d82
MD5 e3757b8c89b2aa096fe7599c7ae1de71
SHA1 3265c17f04c13bdd2c23bc697a8d62e6af176b0f
SHA512 6143799ffa5c47d707d7592d035440fba6a0d8cede257a1d69095350af5d72595f3afb8ba325fbaa00c0badf10006c6867295757d5daee27bc21489f570b8ccb
SSDEEP 3072:6WIeXOOFyLZXu0ipGGXi4HDdYO58q8E8qZzbFlTk:64pFcHRIzbfI
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[8].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\search[8].htm
Size 184KB
SHA256 7d965a58d30fc5c469ccfe595473898f6801ba7f765561bbfe87e0556ea7f9cd
MD5 727a3b62008d7a5efbddb8cf022c6397
SHA1 48781d5526a019f6e57cdc513ac1c0f12b348c13
SHA512 df32330b7e6709cf44f0d108a54bd729a4b7630ff25a67a59d6d38b3893e08d3d8233516909ddcd9905d37ba380f20f59e1dd1c94c21c8fe9b427e5ffcdc5593
SSDEEP 3072:8WIeOsq6PFYv/17pSrUAmtRFJseNgxluoeQ6jyg3zLoz+NZ8w8g8QPke36g/y:8zgFNonoiwNdgkxiy
MD5 SHA1 SHA512 SSDEEP

Submit Download

search595WINNR.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search595WINNR.htm
Size 148KB
SHA256 9f75f29032fef13e294487b2b2c9e3e5b7cd2838a8148864862657481e4794a2
MD5 35d45b2b27c577a958c4ed5e95adac3a
SHA1 0c4a16eaf8b0f2b247cd41e1c12f833015095711
SHA512 9b40463472857682c61e63e4badbd69b7059986abec1712cf28cffd002ce5a62caa34aec7a695a896881c632795da62297896e24e2b701b4407d99343914f321
SSDEEP 3072:WWIeMeUTFYnXsWOgY1CRMbXin4pl74ChYbavAjf8y8D8u8a8J8E8v8+SRAKk+:W3TFI4Xv1f4bX2RUbRNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[8].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search[8].htm
Size 152KB
SHA256 da7491abaf745dd92d2627729ce25638c8b06f449aa6dcb33cc918d08553f61a
MD5 14c25d4fbdd3900a45bd85d95bde82d2
SHA1 0299bcbb9fc6be861f9b039d94631c7c4e128768
SHA512 6ca70cdc22f174bdc933c0cfa8913663cc8cbe8f8a9144b888cb97885311b562f97846c2d197260d0cafd578ac497ea1485806c698ccfcbbfd81495d92b36085
SSDEEP 3072:sWIepJW6uFiTDZ52a2OMHmBxmzvfG2wAA9hnhGgse8B8X848M8n8V8i8TgfDTh:scuFr1R+MlJ8iv8f/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[9].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search[9].htm
Size 103KB
SHA256 8d0cc746c67fa32ef2a7fdfee6213e0784060c528cf5223727690c3e9038f0c3
MD5 c14656ed44d1feffab19300e471465b3
SHA1 17662c80bc734ad38be56fb8db2c38004a795e59
SHA512 01ebce517aa98d1873d7cbe32617075180682af4035bcbf7b4fe0cbb79285d35d45cc5aaff7c8778023f753c53501684763065a0069fb729ffbfaad72f9558aa
SSDEEP 1536:w6e/DsqoamI1MY1H+98gurxp3iGKTTaxQ6p7L777NsHVoBoe1UvJMHqAA/5hkGaA:wWIeISGpv/N0CBBWxMKA2nJMNWFo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5C22.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5C22.tmp
Size 29KB
SHA256 6c2ed20c1016f70cf23c66bbea882f293c808067552e60ed4d5e043d57da2e7c
MD5 5f0c50f75037bd34a771b1b29a5398f8
SHA1 5e8b3fac938c533a97146bcffb259ec431276031
SHA512 034f617f884fed03c50d1d3293eebb295789a53f5b3e622f961fe5824037e4cab046beb2cb214f8c88b4d3ffbd9ac96fd2d8d32d4534910f90e577061b8604d4
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5:AEwVs+0jNDY1qi/qh
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 320B
SHA256 b5b01cf533681d6fe2c57c6b508944148a137eecc273ecfaaef729276dc226dd
MD5 cb3954f60a142ff0f2fa2dea43213828
SHA1 19acbe7c983e5b70b32e466c3b78396346cc7e1d
SHA512 f4918d3fb092d232d54625b70fc2960c5e1981e421cc7a20473c54cd8c327d10a2df2a73bb8224f3620eb822ca1a287be5b9aedc6fd67fc7687d81ed26ed770c
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 320B
SHA256 da089791d364aab7b5d53ef26e9bc1d743fcba30d886ce60534948f81ae17491
MD5 8e39de851681a97b89fe9327476ff15c
SHA1 23571370a7506724a64e26b628a86e9940ecc556
SHA512 99be7efd077c6e47c2230668f28021c1b94ddd84be296bac09a0053295c324435d793c9e40eb9b78043f02ff6824c53574daceb2e6d8b12eaa80201da4bd9606
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 320B
SHA256 3802113f3f02655de7947c76a647d9dfb64a0fa82d1d85dd3bc866d6aa0bbe8f
MD5 81278569ee99c45b7f7fd0e6678cbdb0
SHA1 a37f2aeee9389a27a46bd4daaf05447fce0a292f
SHA512 3212822e76817339a5554733532222de86080f14b14f2635bbce7e0eb749ed4061c55664d6b3a847ef2d983c3b5bc646b8ec678fa111693d307665c3f39c405d
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1276-233-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-87-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-47-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-13-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-292-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-299-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/1276-0-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2292-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-237-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-88-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-48-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-43-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-38-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-293-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-295-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-36-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-300-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-19-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-14-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2292-6-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads