Analysis
-
max time kernel
152s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:15
Static task
static1
Behavioral task
behavioral1
Sample
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe
Resource
win10v2004-20221111-en
General
-
Target
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe
-
Size
412KB
-
MD5
2e7501db16411d9d30287aff096ea7c0
-
SHA1
b4fbae7601c17b7c20709da92f564547c4ecd6d7
-
SHA256
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585
-
SHA512
f49653d5971ed1b049586c78c50b8b91f6eafe50d6ec42adcd85568e90e18e5168cad9f2e13c5d075053ae1c9df2e6b776cccbf48cc2671fdcea2e3c83c6f021
-
SSDEEP
12288:8c9SLkWor+akVC5s/dIdEhtqiXkIvaX/m7bfTWaUUml6iHsyQK2omv4:8c9SLkWadstqiXkIqUs6iHsyQK2w
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
xiaug.exee198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiaug.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe -
Executes dropped EXE 1 IoCs
Processes:
xiaug.exepid process 1576 xiaug.exe -
Loads dropped DLL 2 IoCs
Processes:
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exepid process 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
xiaug.exee198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /h" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /i" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /f" xiaug.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /H" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /S" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /d" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /O" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /U" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /G" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /l" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /R" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /c" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /K" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /b" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /V" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /s" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /x" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /p" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /B" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /X" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /I" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /o" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /k" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /C" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /Z" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /w" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /L" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /a" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /N" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /r" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /W" e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /T" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /g" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /F" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /u" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /v" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /j" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /D" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /y" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /n" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /E" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /t" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /J" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /W" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /M" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /Q" xiaug.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /q" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /z" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /e" xiaug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaug = "C:\\Users\\Admin\\xiaug.exe /P" xiaug.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exexiaug.exepid process 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe 1576 xiaug.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exexiaug.exepid process 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe 1576 xiaug.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exedescription pid process target process PID 1232 wrote to memory of 1576 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe xiaug.exe PID 1232 wrote to memory of 1576 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe xiaug.exe PID 1232 wrote to memory of 1576 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe xiaug.exe PID 1232 wrote to memory of 1576 1232 e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe xiaug.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe"C:\Users\Admin\AppData\Local\Temp\e198c0c199dc91f28a7d17c0cabd6f758c8699b9cc5261ee59468aaca6626585.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xiaug.exe"C:\Users\Admin\xiaug.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\xiaug.exeFilesize
412KB
MD581eec4984f041f109f878ff0fce3f4f5
SHA1a92cfb53d1e9477ebe2b54e27e5d5c83facfabb6
SHA256e1b4f9af3f3798b301548249ed4755575548c5abd1ae4bdedfed958a204d3b27
SHA512cc89b62e30d02e24bb2b29cc0c0368d426bb99bff7cbe16c6adb4440169445193bad5e33d097cbad0ec49932405cd4de77450c6ce72ac33b3b4104a8aa44802f
-
C:\Users\Admin\xiaug.exeFilesize
412KB
MD581eec4984f041f109f878ff0fce3f4f5
SHA1a92cfb53d1e9477ebe2b54e27e5d5c83facfabb6
SHA256e1b4f9af3f3798b301548249ed4755575548c5abd1ae4bdedfed958a204d3b27
SHA512cc89b62e30d02e24bb2b29cc0c0368d426bb99bff7cbe16c6adb4440169445193bad5e33d097cbad0ec49932405cd4de77450c6ce72ac33b3b4104a8aa44802f
-
\Users\Admin\xiaug.exeFilesize
412KB
MD581eec4984f041f109f878ff0fce3f4f5
SHA1a92cfb53d1e9477ebe2b54e27e5d5c83facfabb6
SHA256e1b4f9af3f3798b301548249ed4755575548c5abd1ae4bdedfed958a204d3b27
SHA512cc89b62e30d02e24bb2b29cc0c0368d426bb99bff7cbe16c6adb4440169445193bad5e33d097cbad0ec49932405cd4de77450c6ce72ac33b3b4104a8aa44802f
-
\Users\Admin\xiaug.exeFilesize
412KB
MD581eec4984f041f109f878ff0fce3f4f5
SHA1a92cfb53d1e9477ebe2b54e27e5d5c83facfabb6
SHA256e1b4f9af3f3798b301548249ed4755575548c5abd1ae4bdedfed958a204d3b27
SHA512cc89b62e30d02e24bb2b29cc0c0368d426bb99bff7cbe16c6adb4440169445193bad5e33d097cbad0ec49932405cd4de77450c6ce72ac33b3b4104a8aa44802f
-
memory/1232-56-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1232-57-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1232-65-0x0000000002E60000-0x0000000002ECA000-memory.dmpFilesize
424KB
-
memory/1232-68-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1576-60-0x0000000000000000-mapping.dmp
-
memory/1576-66-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1576-69-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB