81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
Size

41KB
MD5

7091f07a41bb51bd3cabb39102894c3d
SHA1

da2f71dae1b169ead39a56cb816538b4a04d612a
SHA256

81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5
SHA512

3f38be17b1707b4488c400c40e3d506963fd1cc1d09ff9ba564c02bfb20e738d8bfd7c71c7646a7ae11c2e87f0c2c06ff0b3bfc61d4b9062cd5efebee4c00090
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1000	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3224-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x00070000000234c7-4.dat	upx
behavioral2/memory/1000-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3224-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1000-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-51-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3224-55-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1000-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0010000000023368-66.dat	upx
behavioral2/memory/3224-133-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1000-175-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3224-294-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1000-295-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1000-299-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
File opened for modification	C:\Windows\java.exe	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
File created	C:\Windows\java.exe	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1000	3224	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe	84
PID 3224 wrote to memory of 1000	3224	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe	84
PID 3224 wrote to memory of 1000	3224	81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe	84

C:\Users\Admin\AppData\Local\Temp\81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe
"C:\Users\Admin\AppData\Local\Temp\81429bdd57d8646dfce72d566a6c0897372e84cf776859f911bde221d00776b5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MDMHN06X\16FNS18N.htm

Filesize
175KB

MD5
25da53bebf12f246f06846376b88b190

SHA1
7eed1ea6343dabcb8d640bbf3d211fc82a4668c8

SHA256
e33bcd9ef76bc9c01e6f39e132fb5a4d35940c37e17421c4983c0adc0f336e34

SHA512
875ffc9e07e7f41be7fb0479577fb6068ef597270515f152dd131addd6ee431d04f89110bc5581b2eac5170470bd58be23c561825acc88131ebc46e50abafe74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PE7M7D0W\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PE7M7D0W\search[4].htm

Filesize
138KB

MD5
d5acad6ae5cd09c28005db13e590dd59

SHA1
546bb52a37f73f0553d731c16d4ab426a0599ae2

SHA256
7d90e834150e59c6f85889abb9c442ec4956a97306340c2d86112a57a1bf6bd0

SHA512
c3da7e06615a34a13e0db2a0a0713eb1aea0685f6d8a3f92ace072f29e5b28a4f2ddd2ab9c9cb97d51a08fd852c1162a317ec76f2f72fab90f6130781d14cd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PE7M7D0W\search[5].htm

Filesize
133KB

MD5
76591fc2b9b2104e5c2bf21c19831aa5

SHA1
95032cae19681900eae29a60601337320d12942a

SHA256
5521bee97c244f6fbdb0a0b6c721fcc909f2db25a98d7baf4136cda1192c7bf6

SHA512
9962845a6f893d70c7723ad5150d4f2c87b6d9c4b051c0f05df893bafdc1ed6b9d0db32ce0bac1d9032904b8b6fd641c7547a0e036761e73bced7a0eabde0bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VF89GZ6O\MX252V6K.htm

Filesize
175KB

MD5
b72325943cab28b4c864246b4b28872d

SHA1
00a71286fff68f3ac4275441efa817212e681dd2

SHA256
289f3deb1f274ed19ca3cf8f1af2f9b2a8979a55675ff0fe19e4f491755bbade

SHA512
bbc329327822a1a08558c8e1435cc3d13b4dd4c5a08cc1288edf2c6621179ac523b77a30605f505de95fca516f59da4f906a67d095ccf490ff7c6cdfe7890e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VF89GZ6O\results[2].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VF89GZ6O\search[2].htm

Filesize
105KB

MD5
ee56233c7d255eb027a9e66fdcd2486b

SHA1
375933ac107f2292ef1dca684d4d1e21aa95d53a

SHA256
34e5faf752f8746e4f629799d575ebca281cac3c4c353fe7fb84d09d7df54be9

SHA512
3b97a140ae02e10108c0ce7a80bd376035c386ba5ea6b4b64b4d4e3a1ecb2384cb8a008103a36edfda0cfdef3b011297870d368d653bff69e7ffc214ec9c55bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nEypiHb9v.log

Filesize
128B

MD5
d77f10a10a6c000e4dbc6a773e7c87d6

SHA1
034815c4d1a0a01de5e47b9685e0c906eac99708

SHA256
518495419f16687eed19896c77a054c472227bd055f3f75d73e4f0e303fa445c

SHA512
0269049b57c64bce825e99003cd06b03813fffa6eb6264ca9f562466e60886b6c8b88e37bd571758f91ef2baf258c82ba4b0f35fe24997f3cdb94a7348eed8e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5BB5.tmp

Filesize
41KB

MD5
6c4bfbe5347065a6bb67b3332b5794a2

SHA1
65b0958a324a8fe72d8cff00da81f1bb054febb8

SHA256
7ffa439e4db31f23b41af2ed3014ee84e06273de30f187c39402571fd10f7d0d

SHA512
f2bde952acb046cbbcb6a3f72c7aebd6dfebc1c44452fda7a1ae56852ec020047aacf7d58fc26b89e6aa233df5ab8fc9daf021f244dd15b11c634c7e4bc5df30

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
b4179c5f3b1783ab961c59f771fa2871

SHA1
375cee93ed716f0d810bc79a1ef674a34bea8b74

SHA256
b2c6560e3ebe200c559160b518a0bc225f63d6ee8cd8ec3a6e69680640fdc43e

SHA512
7a74a7fcb4de3ef895687e14887848dd73b93fc1c5cd52c9d019ca5958af7a112a5d7e93d3109494d9b5fefab4aa9f41976178e634e5098b8726cde32f7885a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
4a71b6d2b54980341a1eb3a850825a1b

SHA1
3f6bfbbf1319a2ea6a82ad04eb67c3d9397d6b43

SHA256
0c08dc144c5ce0d7807f42496a5b79fc429867efacc0884a5fedd54635b07afb

SHA512
7864278194e5118bf2c51b038743256ef0f151e3d6aca2cfcb91a00ba4c174642ab7c8a2af5e13f116b78a282baa74831ed5a2c0ff641664ca02e524df9b665d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1000-51-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-175-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-299-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-295-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3224-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3224-133-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3224-294-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3224-55-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3224-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads