Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 01:59
Static task
static1
Behavioral task
behavioral1
Sample
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe
-
Size
149KB
-
MD5
910058e8576f630e45d1e6b5885bd9de
-
SHA1
a40cd6b0ad1231da40c4f22926f0ede102a49eba
-
SHA256
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049
-
SHA512
74c5265c351604ad3163f45084035905452837ed93a281b40bab284f3ba5767a65aa285b5355ddb11c1f5f9ba4b7a2e4dbc758b6fd76661a4a55edeb14494deb
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
xianxian.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat xianxian.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
xianxian.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections xianxian.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" xianxian.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" xianxian.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 xianxian.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings xianxian.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" xianxian.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" xianxian.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" xianxian.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings xianxian.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xianxian.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} xianxian.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" xianxian.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" xianxian.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 xianxian.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xianxian.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xianxian.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad xianxian.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" xianxian.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 00361f93a247d701 xianxian.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00361f93a247d701 xianxian.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix xianxian.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
xianxian.exepid process 844 xianxian.exe 844 xianxian.exe 844 xianxian.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exepid process 1948 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exexianxian.exexianxian.exepid process 1748 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 1948 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 1288 xianxian.exe 844 xianxian.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exexianxian.exedescription pid process target process PID 1748 wrote to memory of 1948 1748 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe PID 1748 wrote to memory of 1948 1748 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe PID 1748 wrote to memory of 1948 1748 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe PID 1748 wrote to memory of 1948 1748 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe 25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe PID 1288 wrote to memory of 844 1288 xianxian.exe xianxian.exe PID 1288 wrote to memory of 844 1288 xianxian.exe xianxian.exe PID 1288 wrote to memory of 844 1288 xianxian.exe xianxian.exe PID 1288 wrote to memory of 844 1288 xianxian.exe xianxian.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe"C:\Users\Admin\AppData\Local\Temp\25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\25a65373ed73d1db68ff1e4f547f7c6d886305f38520b909779655475ccf7049.exe--83697ce52⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1948
-
C:\Windows\SysWOW64\xianxian.exe"C:\Windows\SysWOW64\xianxian.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\xianxian.exe--64c3f38e2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:844
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-65-0x0000000000000000-mapping.dmp
-
memory/1288-67-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1748-59-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1748-61-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1948-60-0x0000000000000000-mapping.dmp
-
memory/1948-64-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB