Analysis
-
max time kernel
151s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 09:41
Static task
static1
Behavioral task
behavioral1
Sample
7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe
-
Size
320KB
-
MD5
692ac89574594d6dcf901e891fe97b50
-
SHA1
3c3a8a7afe34901c55114b0a719839517b5cdbc2
-
SHA256
7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3
-
SHA512
b720ac61ead35d6421e7f68f1a069366300fbac4bd83bf5821cd4d28a49ad6ea2f945b095ec998a3e2c0189fd0dc73d0967ccb8ad30a9eda6e464401fdb1d218
-
SSDEEP
6144:wAea/XGccvg2N9rljS6/Vt6MwJD0i/pv8ZaROiixeq6N3sUjgHTvzfHuPwXKjKVv:ga/2vg2N9R5+voeq6N3sv6OVrD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiuij.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe -
Executes dropped EXE 1 IoCs
pid Process 932 xiuij.exe -
Loads dropped DLL 2 IoCs
pid Process 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /t" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /P" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /G" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /v" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /A" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /T" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /F" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /f" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /j" xiuij.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /u" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /x" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /J" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /Q" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /V" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /H" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /k" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /L" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /S" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /i" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /n" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /c" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /K" xiuij.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /N" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /t" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /E" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /W" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /I" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /o" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /Z" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /O" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /R" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /p" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /g" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /D" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /q" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /e" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /a" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /z" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /h" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /X" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /w" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /l" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /y" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /U" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /B" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /r" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /M" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /s" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /C" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /Y" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /m" xiuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiuij = "C:\\Users\\Admin\\xiuij.exe /d" xiuij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9} xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\FLAGS 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\FLAGS\ = "0" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\ToolboxBitmap32 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\ProgID xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ = "__OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ProxyStubClsid 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\ = "TUczMynB" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TUczMynB.OsenXPForm\ = "TUczMynB.OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\edUnOelZ.OsenXPForm\ = "edUnOelZ.OsenXPForm" xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Control\ xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\edUnOelZ.OsenXPForm\Clsid xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\TypeLib 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TUczMynB.OsenXPForm\Clsid\ = "{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ = "OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\0\win32 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid32 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\TypeLib\Version = "1.0" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ = "__OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ = "OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\LocalServer32\ = "C:\\Users\\Admin\\xiuij.exe" xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Control\ 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\TypeLib 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\ToolboxBitmap32\ = "C:\\Users\\Admin\\xiuij.exe, 30000" xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ = "_OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Implemented Categories 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus\1 xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\TypeLib\ = "{2146C4BD-2E11-4952-8AE8-1295FE31C553}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C29CD210-9031-411A-86D4-102E2E228853} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Control xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9} 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\TypeLib\ = "{2146C4BD-2E11-4952-8AE8-1295FE31C553}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\ = "TUczMynB.OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus\ = "0" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\0 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ProxyStubClsid32 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\LocalServer32 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2146C4BD-2E11-4952-8AE8-1295FE31C553}\1.0\HELPDIR 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\TypeLib\ = "{2146C4BD-2E11-4952-8AE8-1295FE31C553}" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\LocalServer32 xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C29CD210-9031-411A-86D4-102E2E228853}\ = "OsenXPForm" xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\Implemented Categories xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\TypeLib\Version = "1.0" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\ProgID\ = "TUczMynB.OsenXPForm" 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TUczMynB.OsenXPForm\Clsid 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus\1\ = "131473" xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\TypeLib\ = "{2146C4BD-2E11-4952-8AE8-1295FE31C553}" xiuij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{755233FD-DE55-4724-85A0-78CD170AA9C9}\ = "OsenXPForm" xiuij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5773FB6A-3127-4094-8DD8-76C2C4CE6F40}\MiscStatus\1 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe 932 xiuij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 932 xiuij.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1300 wrote to memory of 932 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 27 PID 1300 wrote to memory of 932 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 27 PID 1300 wrote to memory of 932 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 27 PID 1300 wrote to memory of 932 1300 7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe"C:\Users\Admin\AppData\Local\Temp\7e83816aef333746e844bc051cf63757794636a30e9826becaac72a961a170e3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\xiuij.exe"C:\Users\Admin\xiuij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD57ba798a81eb1b85d1475ef349358cffd
SHA1e1a8598d994a801297f4d5b18bb3a6eb2c4c1f4c
SHA25664b5eba577cbfaa0898c7445a51d4c22f7f99fc3355ea2bb83a47a44cf0ef770
SHA5129f5a45c88bec18dce4ee00a3a90a9096d2c09c36564a9522d95353fe6c4d107706079a8603bb86e5ced208dcc2c60e3deb0b9a049f36212c664e7ffd8dd96f7e
-
Filesize
320KB
MD57ba798a81eb1b85d1475ef349358cffd
SHA1e1a8598d994a801297f4d5b18bb3a6eb2c4c1f4c
SHA25664b5eba577cbfaa0898c7445a51d4c22f7f99fc3355ea2bb83a47a44cf0ef770
SHA5129f5a45c88bec18dce4ee00a3a90a9096d2c09c36564a9522d95353fe6c4d107706079a8603bb86e5ced208dcc2c60e3deb0b9a049f36212c664e7ffd8dd96f7e
-
Filesize
320KB
MD57ba798a81eb1b85d1475ef349358cffd
SHA1e1a8598d994a801297f4d5b18bb3a6eb2c4c1f4c
SHA25664b5eba577cbfaa0898c7445a51d4c22f7f99fc3355ea2bb83a47a44cf0ef770
SHA5129f5a45c88bec18dce4ee00a3a90a9096d2c09c36564a9522d95353fe6c4d107706079a8603bb86e5ced208dcc2c60e3deb0b9a049f36212c664e7ffd8dd96f7e
-
Filesize
320KB
MD57ba798a81eb1b85d1475ef349358cffd
SHA1e1a8598d994a801297f4d5b18bb3a6eb2c4c1f4c
SHA25664b5eba577cbfaa0898c7445a51d4c22f7f99fc3355ea2bb83a47a44cf0ef770
SHA5129f5a45c88bec18dce4ee00a3a90a9096d2c09c36564a9522d95353fe6c4d107706079a8603bb86e5ced208dcc2c60e3deb0b9a049f36212c664e7ffd8dd96f7e