d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
Size

29KB
MD5

adee2820172cf1eebcb6539a380831d0
SHA1

77cafa3a899d4fb94b68ff49bc91539fab01e7f7
SHA256

d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b
SHA512

623940e7f86de1c98f313046e492c504789707bb6c1da502d854cd37736808e913c63f5cd27a79060afe9255c19fd517f9fb5c7c5c44c681d25323f0c4a8cac6
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/N:AEwVs+0jNDY1qi/ql

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3976	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1880-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023424-4.dat	upx
behavioral2/memory/3976-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3976-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3976-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-25-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-30-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c0000000233ab-41.dat	upx
behavioral2/memory/1880-208-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-209-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-260-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-261-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3976-265-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-269-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-270-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-335-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-336-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-339-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-340-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-376-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-377-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3976-379-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1880-392-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3976-393-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
File opened for modification	C:\Windows\java.exe	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
File created	C:\Windows\java.exe	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3976	1880	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe	83
PID 1880 wrote to memory of 3976	1880	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe	83
PID 1880 wrote to memory of 3976	1880	d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe	83

C:\Users\Admin\AppData\Local\Temp\d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe
"C:\Users\Admin\AppData\Local\Temp\d9a72d75260e3d42513b0e4baf1872ea02161e966576a67453b07bf12a00db4b.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\2LXVYHP5.htm

Filesize
178KB

MD5
10d6f55a406dfcb7b288e700951bda9d

SHA1
4bb4cb766f67b1759e9e31fd04000fb9fff93fd6

SHA256
269b0c531d3aeeec0457a14eff19fa0e420fb222fdde32fac903f212bffe7005

SHA512
98a407204d823d19ec6d2497dc76c268ab7f20a40ed02f8c7f3df6ac52e3e5ffe54d04e0fca6ab2ea20152d449f92bb3ea0ac2d9352860d3065c1963cdba799f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\results[2].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\search[3].htm

Filesize
116KB

MD5
ac55d2fa772589d511aaaf13e91dc101

SHA1
8126864b09409cdf6ab83f3dcc1503c558a2aac3

SHA256
8ede0c72f5c1468b77755a85001b7a32676d9b1a53c8e1efa368cf6aad1b436d

SHA512
a2e56c543e5cc091d1981d7c5822118e194c1c1593f8fb2c7629ee1783615c187e743fcc1c1c7c95f713af1eb386d9a91ed83429ba9c53df049179003b2e1ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\search[4].htm

Filesize
131KB

MD5
06c19bc46275693c3f04ac08b172126b

SHA1
7e036d46216a2104aa60149da8599730c229c258

SHA256
80bb6acb8e814686220340fe914fb3fc519ca08e92daf8f4c8c881146a62447b

SHA512
5fc857f60f160159b8ba0d19e96aa49e3e5280d30d18c0865d6f0e55e9ec14e1657bad03232eb2c0034aa2ff6766dffffd1600f2b02cd524b063105d9eb5234c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\search[7].htm

Filesize
147KB

MD5
3ad3b0d73d95e79ae30a4a4781fcfced

SHA1
30996b6f69271f3292c4ccb3ccf9de8077e4387a

SHA256
aceb5f420e550dde416c2877a4762a452f7fc7a963b0a5212e218061a8b904ec

SHA512
e21184852b29e9540bba3329ca89dd886b79cd7204031b94871a15a4944c590002f0947fd9b854bc5e074d8b88b84ee52858091fe3e90b8d7fb4a9e97ac22874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\search[6].htm

Filesize
159KB

MD5
ccccd8b32c97f35f4b990b05b6c0250c

SHA1
7a09fa1822a8c5befbb073e1fe21660a8194267b

SHA256
eba8bbffd7890d3a2644f919de09e190db06683294e58a382732a9457a68fe27

SHA512
1d948b6c739a560b587610909a481f1cdb9fdf88010fc6648ee49dd70a93d44526f8fb2a987d29b40a54d365e21ce8a5d3d72375e11ad9dc9d301ffa759ac1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp50DC.tmp

Filesize
29KB

MD5
57a8a9efbef34db5d0aae0d86ccad05c

SHA1
a120961ccd8f9778074ba54b8a42744dca0765d5

SHA256
c6c6b93cfc04c030a8e686d083cd5b5ff8dcf7847b53840b29d4e3dd84ce9ed1

SHA512
7dfbf46661cd8670207a55e7ebf377760b447538cc1fb78220a9b92976fc6951da9c5cbba034a666eefcf064389dfb1c8d601ac386d1260b3b2f556d1bf57e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
448c2c96074601c74d776b915a7e9ae2

SHA1
513e5b3c280a25392786130892026da8917ff870

SHA256
6f488973d6ec393eef3d447f6772cae5fe738f8125dfd4ab2a97b3e02cb4fd2f

SHA512
ba3ddbb925b4724059b97c550f0fc5a5d6e2cd5a4e6c4e04f7bae44edf39af8d22fc9da0e69443d54bc97644a1ce87456e8b4563be0919ae20fa62ceedade0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
cdc798e7bbe54717c2a0349fc4f934b5

SHA1
8e824fc8c069b18b4eb2e56c6a713840c76d023b

SHA256
2b8bac5529b40a9cca988855ea6a13e5c7ebe4b08c7cb620de6c11d3d6380a03

SHA512
70b611cd9b35e329ffe3b50d33556d693d18592a85a5429dcde34baf706e53fac965f03f2719a4c4b304a709796d09c8c6099d1b13bbbd19d65144d3ead7d7ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
2b99a520fc6f30bebe35738dedae8368

SHA1
e7872c0e69e86599e4c0598852a17d2b56b60d2d

SHA256
d9de9ac6b9c60d5f90022c8d5de8e4ab9e2458900a096631aa1018cb36b31409

SHA512
79caab37432182a7f62128378e906cbfa00d67b7cdaacee2a2e6b489efdcd3b72885229084bec2cc847ad3cbc12d8caa072840c49af5ceaa06a90106d4c93510

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
f68122718899ddbe092572b58159bb7e

SHA1
591b9ecb0aea00275073e2a65347ccfa2255167d

SHA256
b43d6c11c98edad07b9796535c960aca44967021789b367695476c38ec401ebd

SHA512
b6959c0e94fb564fb60cb015c817b3edb0ed0dbf392c57a1b0998eafa7098013ca3f0ef37a8052f3cf0122b6e6a3c52b8044d5f54b69ca183cf3cb4a93b473ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
b5aa5a5dce71b7c01493921dd78745b3

SHA1
fd93e21d03811f9653e2ea4cd3fd0ec7b3b99e1e

SHA256
6d8a566aab9459118f31b1318a5032478961658ce3f6ce75b5b2f404c17dcd38

SHA512
ca44e71896e5a0f4c277480a68d96e6b26c38eda6c70990d46ff9f585a10eb92b4d22d92d6c0a6b62a69d6f212efa4101f118e148a5b7d6f16890ad45dba35e2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1880-30-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-25-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-208-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-392-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-376-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-260-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-339-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-269-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1880-335-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3976-261-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-270-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-336-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-265-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-340-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-377-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-379-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-209-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3976-393-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads