Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 10:23

General

  • Target

    9fa6982704d9d753c05707fed79080325d944bcaaca69bc6cea0d41780695218.exe

  • Size

    128KB

  • MD5

    804c9218d5ae5127a155d3fda262e472

  • SHA1

    af9cc7fda339afcf87e1cbe3091519b9939be918

  • SHA256

    9fa6982704d9d753c05707fed79080325d944bcaaca69bc6cea0d41780695218

  • SHA512

    cb9448b8484a9f70f2c3843982df2b17eef2a1db6bafa617447d5831a99a444acf402928a326a0062bd9bdabf16f7cef32e298b6e21fb9e1827a51b15f8ab0aa

  • SSDEEP

    1536:P9fsifAhgIuFQFvHwd6PXOYb7gXWgWKsEHXNeG0h/y:1fsifqg/FQByYb7gvsEwq

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fa6982704d9d753c05707fed79080325d944bcaaca69bc6cea0d41780695218.exe
    "C:\Users\Admin\AppData\Local\Temp\9fa6982704d9d753c05707fed79080325d944bcaaca69bc6cea0d41780695218.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\xiumi.exe
      "C:\Users\Admin\xiumi.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4780

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xiumi.exe

    Filesize

    128KB

    MD5

    810147ad4f73a9460898fd5832c2ea60

    SHA1

    388254dd5bcc411c09cba4ea7c69386b6a16ba20

    SHA256

    6993327650a797abc5118318c91f8db95957feb7f3b218010bec4290d26bc0eb

    SHA512

    7119db1f0499b17e0c593d910cd712ae2636ea175ecd43af6dd36a1912c299abccd040536f007e8e9cca2609df2184cd9a476bd91bd895084307c263af07c1ff

  • C:\Users\Admin\xiumi.exe

    Filesize

    128KB

    MD5

    810147ad4f73a9460898fd5832c2ea60

    SHA1

    388254dd5bcc411c09cba4ea7c69386b6a16ba20

    SHA256

    6993327650a797abc5118318c91f8db95957feb7f3b218010bec4290d26bc0eb

    SHA512

    7119db1f0499b17e0c593d910cd712ae2636ea175ecd43af6dd36a1912c299abccd040536f007e8e9cca2609df2184cd9a476bd91bd895084307c263af07c1ff