Overview

overview

10

Static

static

7

9c8e8c7429...93.exe

windows7-x64

7

9c8e8c7429...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9c8e8c7429500977823bf081a13f088b5719469ccde46cde393239c584d1f793.exe
  • Size 41KB
  • Sample240711-daefsavdnq
  • SHA256 9c8e8c7429500977823bf081a13f088b5719469ccde46cde393239c584d1f793
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c8e8c7429500977823bf081a13f088b5719469ccde46cde393239c584d1f793.exe
    "C:\Users\Admin\AppData\Local\Temp\9c8e8c7429500977823bf081a13f088b5719469ccde46cde393239c584d1f793.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1784

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        X2OQIDI3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\X2OQIDI3.htm
        • Size 175KB
        • SHA256 68c1c08acd3de41d9c874aaa8af4beb04d191db096536cf6f442b75c1613b0ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\default[2].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        search0Y3G727T.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search0Y3G727T.htm
        • Size 115KB
        • SHA256 6a665ebf9213ba1588b4234e9362f62d190c9b084f6a7f619a09543cf5353ddc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search13SJ3UXM.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search13SJ3UXM.htm
        • Size 133KB
        • SHA256 889468de7bcc3b615799e284aeaaf619bbea7201826ba657c440b5c32ebe29ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search[4].htm
        • Size 158KB
        • SHA256 833652b24b2fe5af2b52e5575f7de5ce4a5de34403edad1470f7431a6c0eaa7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search[6].htm
        • Size 142KB
        • SHA256 b37366daaad89fda2f0b1aac8b5af3c09bd67003e5f7985c94ed9fa8c3c39f61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search[7].htm
        • Size 138KB
        • SHA256 936a8ca9e9e6538e1667eb2e78ae321c6a817c0c0eeff240c94c32dd96445b13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search[8].htm
        • Size 129KB
        • SHA256 20cc4ae92b49ab07dd061cacf36dc274fc953ea65ac0f72a4df638b51906c3b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\results[5].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search0PM271UI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search0PM271UI.htm
        • Size 173KB
        • SHA256 9110ddef4dc329c3907c26d28d679c1cfb4b8f7e34c1d4b61d54fc259e7b9417
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search8LZF1ULG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search8LZF1ULG.htm
        • Size 156KB
        • SHA256 ce75635a00374dc125389f97923e63e807212217b5025310da091b052f4d4282
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGH0JRST1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\searchGH0JRST1.htm
        • Size 137KB
        • SHA256 1f4a970753aeb5f45603b554fa09ab6269d257efc1c4abfe03def54bb4cc156a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchTK0KB3EO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\searchTK0KB3EO.htm
        • Size 172KB
        • SHA256 cf9c2070ca270648d99108bffd7531dadfd0dae57fb1302442c1251356ac5ed2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search[8].htm
        • Size 151KB
        • SHA256 2b979467242b5a7b1591c7ede00f97e1adfcb841047877ba84f756bb83b7e82d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\default[2].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        default[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\default[5].htm
        • Size 309B
        • SHA256 bdb7ac94dc916af2d7784a5c147167ce13e49d12baa9b8f3cccaf33e29419a7c
        • MD5 SHA1 SHA512
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        results[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\results[6].htm
        • Size 1KB
        • SHA256 3c0cf785ae4898fab36c8e6e6d1ff44a1b980db0216539cc895157efe273da2d
        • MD5 SHA1 SHA512
        Submit Download

        search1C4OKIDQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\search1C4OKIDQ.htm
        • Size 139KB
        • SHA256 37f448df80153f06e5358ae15b7c58c93368bcdbf696ce7672bd53051cc54ad1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search2T8DZC4N.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\search2T8DZC4N.htm
        • Size 112KB
        • SHA256 c4544c490b6a0e273f620c57b9523b4f8074678725971e651aaaf3906171724a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchFOC0H24H.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\searchFOC0H24H.htm
        • Size 162KB
        • SHA256 d334b8926ab5b82422256dfd01c7d75e85b7a7b7a4574a67ef7192ca8e7a34a6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchPGM0YJZO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\searchPGM0YJZO.htm
        • Size 130KB
        • SHA256 e46086c19580196052f5fa991c59ffb0a3935281e38b0253fca8bd025ff7ae3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQFYR3MO0.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\searchQFYR3MO0.htm
        • Size 134KB
        • SHA256 a0cd7a7754a1603221f2fdf01ec7e7b26113788d30978d690c2eee64ecfb1c70
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[2].htm
        • Size 141KB
        • SHA256 060a2e207fae1c25e5f556642727ef331fa1575ecd92709c3831c4d0efa265c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[9].htm
        • Size 144KB
        • SHA256 7f0f837a5197ed85c081331674f0dc4a1a2ee5e636e51259f30545e3496582af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mijfxt5nE.log
        • Path C:\Users\Admin\AppData\Local\Temp\mijfxt5nE.log
        • Size 128B
        • SHA256 66dfc480a4a19ef9dbe61eebc77dc44d7a12edbd7f16cd816282696a029fe4ca
        • MD5 SHA1 SHA512
        Submit Download

        tmpAC5A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpAC5A.tmp
        • Size 41KB
        • SHA256 a0d322b760c880f7e2b67c6ef7fd9dfc0c2a4018f4a178e238100e602b0188a1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 6362253b619f5c9f676a564861004c4edd9871268cb559d617befb4451e12236
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 3744a4b55f2ec6938ddf717c638a72f2090a9015f58c757ae2f775e88df620ed
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 2a5be9480a5e5d323bc2ad831e0116b75f648a6f3a6e0ef110620e3b30fe953f
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1784-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-230-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-228-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-235-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-194-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-499-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-38-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-711-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-312-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1784-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4452-498-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-710-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-234-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-37-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-35-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-193-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-227-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4452-311-0x0000000000500000-0x0000000000510200-memory.dmp
        Download