Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:35
Static task
static1
Behavioral task
behavioral1
Sample
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe
Resource
win10v2004-20220901-en
General
-
Target
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe
-
Size
144KB
-
MD5
3a34c964fc0e17eea6a09a776c6bcff0
-
SHA1
9d5e8149940bd1ecb7a7f907241be119bc4dbb65
-
SHA256
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147
-
SHA512
12de82f52967e7841a2c5062967eceb1f1b7cbb5fff844cd0dcfe46a87f590699be945a61755a1eb594838f4b3c28c79ad6e23c6599d6fa1f115eaeed6286e1f
-
SSDEEP
3072:NHKFKfj2vhINgVs+Y9YXeKjxF1yj13TWDnt5:NqFUjWq2gYuKjxF1ss
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
xsjem.exe64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xsjem.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe -
Executes dropped EXE 1 IoCs
Processes:
xsjem.exepid process 4796 xsjem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe -
Adds Run key to start application 2 TTPs 54 IoCs
Processes:
xsjem.exe64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /m" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /C" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /Y" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /S" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /x" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /H" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /o" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /U" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /G" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /h" xsjem.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /k" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /R" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /A" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /F" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /i" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /M" 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /L" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /f" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /T" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /l" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /D" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /v" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /t" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /Z" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /y" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /j" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /P" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /z" xsjem.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /O" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /e" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /c" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /u" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /X" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /w" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /E" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /K" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /r" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /p" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /s" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /q" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /a" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /V" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /B" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /g" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /W" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /J" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /N" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /n" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /I" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /d" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /M" xsjem.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjem = "C:\\Users\\Admin\\xsjem.exe /b" xsjem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exexsjem.exepid process 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe 4796 xsjem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exexsjem.exepid process 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe 4796 xsjem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exedescription pid process target process PID 1960 wrote to memory of 4796 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe xsjem.exe PID 1960 wrote to memory of 4796 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe xsjem.exe PID 1960 wrote to memory of 4796 1960 64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe xsjem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe"C:\Users\Admin\AppData\Local\Temp\64dbd0555bff64544f0a1d773296691e29e49927da77ba9410e351efb55b5147.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xsjem.exe"C:\Users\Admin\xsjem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\xsjem.exeFilesize
144KB
MD5da7fdf6df4510380f5c849ca5ce74bd9
SHA1fcd39e2cd06991ba3c94bef50f2fd1431032b925
SHA2568152fd86361beefe19c39d9774a833d23d2478817e9439bcab9dacfe66a41187
SHA51263fd8f34121d691a92c223af836488f4e9cd004478465b20224df4df7098e670cfd229723f57eb5e7be1d13de16dd3cb95bf6334b60e54e6eb5dfae3ad72535a
-
C:\Users\Admin\xsjem.exeFilesize
144KB
MD5da7fdf6df4510380f5c849ca5ce74bd9
SHA1fcd39e2cd06991ba3c94bef50f2fd1431032b925
SHA2568152fd86361beefe19c39d9774a833d23d2478817e9439bcab9dacfe66a41187
SHA51263fd8f34121d691a92c223af836488f4e9cd004478465b20224df4df7098e670cfd229723f57eb5e7be1d13de16dd3cb95bf6334b60e54e6eb5dfae3ad72535a
-
memory/4796-134-0x0000000000000000-mapping.dmp