2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe
Size

29KB
MD5

4dff29d8beb0337d45975346f5981814
SHA1

0ce223985906bcdc576550c922f4440fdc904653
SHA256

2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a
SHA512

abdfbc241884458bd7b215d3d77acf6963bb9af97faf687c1d45b11925f14598301fdcf954466dee7317abff04c747bd8ed275518d894d2baaa1430e01789ab4
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Nc:AEwVs+0jNDY1qi/qe

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
1092	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2588-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023410-4.dat	upx
behavioral2/memory/1092-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1092-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1092-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000b00000002342b-63.dat	upx
behavioral2/memory/2588-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1092-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-320-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1092-321-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1092-323-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-327-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1092-328-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe
File opened for modification	C:\Windows\java.exe	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe
File created	C:\Windows\java.exe	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1092	2588	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe	84
PID 2588 wrote to memory of 1092	2588	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe	84
PID 2588 wrote to memory of 1092	2588	2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe	84

C:\Users\Admin\AppData\Local\Temp\2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe
"C:\Users\Admin\AppData\Local\Temp\2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\147VZ9Q6.htm

Filesize
176KB

MD5
ef20132b1f11ef645fe3c774a468e986

SHA1
8cb89018043d2e40a195766f0b89b2a6b8b017a7

SHA256
27fa57fad205bbf1c4f38dc8237d5580a375d5969a88b7ef033c0d41923e09ad

SHA512
0b8e71a530437236bd084f3f439f7c304f1a67b4da86ee2b9a64421a7845ab98fba10ea27985fcfa1d1c998e2654816c02d10f887e433a29c4b965058bf80329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\results[2].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[9].htm

Filesize
134KB

MD5
3fae6543ec71fdf389d76da8dd966928

SHA1
97ba1d3ea4ff18580e39e75b6b0a66a2ccdc24ea

SHA256
76d0a11e17aa5df76e652d3c91f9949dbf3083d6d52a6867c3ece941b3cf09a5

SHA512
cbc552cdda02efd4c302eaf4e4376013c11650b558b865869999d1f880a8ff1d2be0b984a759f37bad61474d6a5ece6fdf7eaae948b0feb64ef62e59a32c39e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[5].htm

Filesize
115KB

MD5
5894c6b707653c71957cf658c5f8bdbf

SHA1
f632be57ea440ec0097e13b8e1fbbee6a66defd9

SHA256
3a3964f91262f94c1239eac51d9f272d2d200519d3cf8db7eb4fefbdfbc1d8f0

SHA512
8fc76085b0835d363a55fba1b07cb5998f622bc6f4ca34ecc885195bb2b2bb8a2654756ecaab129f384f1313caa0b2eb5242cff44152bd93114452a04ba52ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2052.tmp

Filesize
29KB

MD5
4dff29d8beb0337d45975346f5981814

SHA1
0ce223985906bcdc576550c922f4440fdc904653

SHA256
2fe7933225f23861575c7adfc4fd28c589dc2d6b7ec47f50c507cc21401c406a

SHA512
abdfbc241884458bd7b215d3d77acf6963bb9af97faf687c1d45b11925f14598301fdcf954466dee7317abff04c747bd8ed275518d894d2baaa1430e01789ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp212F.tmp

Filesize
29KB

MD5
25e7932cef513684cab5f62c9de653cc

SHA1
c657a0310a429b3f5a59b65152bc66d82cb4f1b9

SHA256
df8bb1b7f283b3eb1bafb5b3c032cfe6d7a472b77592049fa07272f69862314c

SHA512
06599a45f2d01245c3a1ca8b45bda54567edaf1a8e230fe65735e9000c262ac2adc224e64ee72a483d474bd2c79a8eed58ef7257d32229bea428acad0e805bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
a7a3d6e1036f28d1136e5c60bc5a1bf3

SHA1
184edd164f1d937ca8ca64bd155f14ab08b4e2da

SHA256
c95a388476c6cc814ca719460f245d62780a5002bd06c9ed0bf01d1d63c18e72

SHA512
e212ef9e093c5fb704e0164b4d42d82cb0d1d1d9d744ad2ac687c07af0409643980d0489096f29e74e579161f5377e82b659ba2db9bfca936ece55da30de88d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
70f7fb181a0b5a1d5c7d8764f062cf2b

SHA1
15f1a1c0f9128ec4877a715966edaa07bfc0309c

SHA256
432239eaa13986ebba9905f877c79418c59a7306dad932a41d72c2cfc250da05

SHA512
a7e4087e85f93678e6488c878105005368fa72270cab0bad36815383fd3d23c1d08dd7534cadcc23f0db9431b8b595d374cf7586401c77cb5dcf8a6007f869f7

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1092-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-328-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-323-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-321-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1092-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-320-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2588-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2588-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2588-327-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2588-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2588-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads