f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe
Size 41KB
Sample240707-gfsgdavepp
SHA256 f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a
MD5 829561ee87321ffa2121493fa20104f4
SHA1 6d88ed7ce8addad09cb956ea9beec8cb4cb36d36
SHA512 df5a729cdb3d03cf2c14abf2d47f5ff40dd87ae5abed0ee7e09fd41b6d10d80149c44f6e79f8001bd83e1a1ac715b6d026067f20453f1e37999d2198a52d91c7
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
836	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3000-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x00080000000234a0-4.dat	upx
behavioral2/memory/836-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/836-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/836-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-25-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000300000001e755-34.dat	upx
behavioral2/memory/3000-115-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-144-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-241-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-242-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/836-244-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-248-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-249-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-288-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-289-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-320-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-321-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-325-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-326-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-379-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-380-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/836-382-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3000-512-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/836-513-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe
File created	C:\Windows\services.exe	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe
File opened for modification	C:\Windows\java.exe	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 836	3000	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe	82
PID 3000 wrote to memory of 836	3000	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe	82
PID 3000 wrote to memory of 836	3000	f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe	82

C:\Users\Admin\AppData\Local\Temp\f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe
"C:\Users\Admin\AppData\Local\Temp\f899c406a189ce19fa3919c1968dc991e20c7db829cffbc687f1cb1dff4e9e1a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2MK2FS0A\search[2].htm
Size 144KB
SHA256 cc8fbc52374077a956ee814dc0fe7a6674419578a6fca3f191fe8787f22e5fed
MD5 61a713acb2bf89ec9835022d3d8d5245
SHA1 9b9e1229f74eeac8399a934882d5549bd1b2cd6f
SHA512 ffe42a914a8f267a5e804bb67ad3f2b39677af3e6e5920d52ba5c332090f05d377e2cc2b270d4915d6dd60e292e81d15969ddbb55d40ddd60da2e4fe3b823e59
SSDEEP 3072:yWIejvXTFheQ0dMUJcPcs8aPuXl9UEMr0b868w8GhwTsg:yUbFOimm3N4w4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

default[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BZ4S5TP\default[4].htm
Size 312B
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
MD5 SHA1 SHA512

Submit Download

search[10].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BZ4S5TP\search[10].htm
Size 117KB
SHA256 e9396b5415177e10b5e147b71c98d91c7e611ac8d375bcebca49bfe355431221
MD5 916a6e452de9e9c388a238d930d0b052
SHA1 53b0badccb1934ef6d8003c376974afbc5d7079d
SHA512 a0db9f55bff4bc4ed09d7c97d1806729e50c4de258e917a7997fc8417e0365dcfac9e9f375199ccb40b2aabcd3207fe82ed75b39d0ba0692c79bd32de25f5166
SSDEEP 3072:YWIe2APOFkjZIFI0bYMDBpZfZgz8q8v8s8c8T8b8c8ZyZp7J:YHAWFBHUp5oA5gZ1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BZ4S5TP\search[2].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[7].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BZ4S5TP\search[7].htm
Size 120KB
SHA256 d611698c98ce99d2eb1351682a34a4dea55a0ee3b2388c911ef9d9804635eb2a
MD5 1a2e2716816aa4e53039c57bdefdd4b7
SHA1 b0a2c75a599afab18c8b5343a51a7c33c0187077
SHA512 95b2fceb53fae38fa4ef29b110e48d0e49d52ae52007d09902e502a5fe8e846b89885c67a14931db7c3206799bde324ecc4bf4a7eb66342fbef1113e1a0138d9
SSDEEP 3072:2WIeT/ZFx7r+2vrEu7uYlr7PuQdq8EDzpy8d8D8m8G8D8Q8L8Vr8rmk:2ERF+64jD4tQZ8Ck
MD5 SHA1 SHA512 SSDEEP

Submit Download

32R3PV2G.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q42GXF10\32R3PV2G.htm
Size 175KB
SHA256 86ef1e82e11f5321c3962eea6fa14839b7c5f9cdd25298bfca34208e21a45bd1
MD5 d44838289c222a06741c03ba34b7c5ca
SHA1 45c4929ab34bd92ab6f2e34544c9f921d3783ff1
SHA512 7868f9b2108eccc44bb0d9db0a549a1a94454ef30c132c19096eace0be01e3afb5d03ca8b08399cc5507e887e312f7477922014820ded341e2c71bdedbf47d37
SSDEEP 3072:G4IeGAzVCbS0ZK+QG58TJLqIetIeBk8DT:G9AES0ZK+QWD
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[6].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q42GXF10\results[6].htm
Size 1KB
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
MD5 SHA1 SHA512

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q42GXF10\search[3].htm
Size 138KB
SHA256 f28b27c9e43b00c30c390afe2751d156447f4fbb09ce20565dae8edf4cf142a3
MD5 b9ff90191e5065cb5a4b3172fc3fb471
SHA1 05273f389e2f5c810b401ac2ba374b235de84b9b
SHA512 a993e56483c44a5eb25bcea0013886111105ff712d9892dd9509d9839ded8876555c99d6a7490fa77338938939ccddc80b35fdbb6e1e46c100148689eeedc249
SSDEEP 3072:CWIe686FCCgQEdUtAqtQmDCIcTfm8D+9Wqt7notnrCd8K898m8n8t70Usf:C1XF3Jenaj8p0Nf
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[8].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q42GXF10\search[8].htm
Size 125KB
SHA256 e61b0cf369a649082c157ba60faadc89796a51df243627cf056a71b770c9d17c
MD5 1d934cc650eaf9f08e991dd8b9bfa3d8
SHA1 95eb0c400ae9e32d65abce127431d76b266e0d9b
SHA512 7debb323cb36548127f9e9688f6d015834535dbcc9d9551519da174261214757068a417c8efd20f9a0ac4c6d3b1065c26e21c5ab87869d85695ae06630da7d9b
SSDEEP 3072:YWIeIxOqZpnZ+MrxtdDbwwlNmdcLAXjKKltVA3D5sVfAn:YdUjVVon
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VYPBNTML\results[5].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

dilcq.log

Path C:\Users\Admin\AppData\Local\Temp\dilcq.log
Size 128B
SHA256 b163078655ad9e9dfaccbf3f975334be0ec66c5871858559b3fa407d205e5e59
MD5 03473bc98ad872789fe759b186b57426
SHA1 476001ec9c521a91cfba10e22a59f280efee863a
SHA512 3b18589f46451bc062904ef9ebf3bf2bee2b4c1cd06c3d2973c2869ca9510ce195f3395b5d8eb52da6d877f0059ee96242ad68e48fa03fb3844f982f37987b33
MD5 SHA1 SHA512

Submit Download

tmp8F2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8F2B.tmp
Size 41KB
SHA256 64c7b9dca0dacc1c5c8507781428b89105efd565e5f1c42e833f25b98647219b
MD5 29553eed44054efa63a76b538082056e
SHA1 975d5f9ef5f31e8163a864ba659b5600ce00cc73
SHA512 abc60508f6591413b1eda1f0deae892c58160a0512b6732eb88f75a2f36e4b34f70a32e988572039ed919f382466bcd968d302032351cad01d2b27c019ee2d65
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 332347ad60f5b72f98a35bf497c8043a1c5461951d320094e4c7d67176cc8afb
MD5 4f0d185e7a17d5505fc976e91e1d37d9
SHA1 77a2697930566765525fc0deb8fe9d4bd1ed0165
SHA512 b18f493204d7a12f1a2258cc2f4f326b10af9966d306f7b67cfa4b0e7e93109aff27ebc67f45389690177d08c0b47d1aa88971a145655326db3efef9c0237c4b
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 8f79de164b2e2ad62f17331740bd4f813158f6bb65b1769f13d0eb2d68a5a302
MD5 76c81046d3c4ecd494f2ae25bb5b453a
SHA1 b1a2dab629ef43ddbd07082d5d6e06390eddc1c3
SHA512 eb2787b1f259edefa63d05a3b7a30336546d74e0c95a1d8ab68a5dea8486b96bfc75a9c80d05a959bcb6480d73eb4e643f47a4ec9e960bfbc558a17be2aaf96f
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 e50e7767bfda6eae0ac4a6dff4fad967be3649d8216c6d4b78a433c0d3c635f2
MD5 bb384a02fa2aec55e3efaccb518d97be
SHA1 7c1cb941b7ce64fe625c5a75e8e24e94bc4f43e0
SHA512 a84bb9e3a5dc0d95317418b7a3fcd7cbd57e0a2d7fdd9097545976c11b3a3804204d3766280324fbff52c7f2707981b50fca038a5567f7dc3d92de9f090188eb
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 859d36112205c925ebcd0b01eaffbd214a57ef527420291f6b8ddb886879c5fc
MD5 e675338108c1d324a753b506e7c84c64
SHA1 c40102ee4e0c52de8ea50fa3a3ac467b0a0be9b4
SHA512 177ef5e0269952016e8be83c0b4a383b17f93e6c2e3614b34fa5d25014c7151c29377f1ad191df1b859c4e954a20bb8669f042e1aaba7b56ef1840ef2a69f1d5
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/836-244-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-513-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-144-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-14-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-249-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-7-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-242-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-289-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-19-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-321-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-382-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-326-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/836-380-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3000-248-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-379-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-325-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-320-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-288-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-0-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-241-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-115-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-25-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-512-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/3000-13-0x0000000000500000-0x0000000000510200-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads