01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906

General

Target

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Size

368KB
MD5

7fdc8ff1a7ccaffa8106ef8d1ce38ecf
SHA1

f3599b025bc9aeeee6927e174d9832b8b4d13609
SHA256

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906
SHA512

9b20e1a6b1720aba73b7edf1d4f0c9dc31816178cc5f0dd42b2bb6a0f4def07bc6e238c26b4d91030ffc8368e99992109e32b1752b88c99b872acabb72ca45be
SSDEEP

6144:EQI+unmhtgoi3APh5to5tvkxMjAkc9GuQlcpld+JDIPLKTGeS:E7+umrgoi3S3WvYLsuQUdUDb

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid process

1600 01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid	process
1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\XupiXnewh = "regsvr32.exe \"C:\\ProgramData\\XupiXnewh\\XupiXnewh.dat\""	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\XupiXnewh = "regsvr32.exe \"C:\\ProgramData\\XupiXnewh\\XupiXnewh.dat\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 6 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exeExplorer.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{778737FA-1487-4AE0-92C8-0D682CF36CC0}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c303166333162656639366230343362326363636665316336303734393766336661633062346337303237336537346439323934363964363732376237623930362e65786500	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{778737FA-1487-4AE0-92C8-0D682CF36CC0}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{1E154E4A-622B-44BB-9F63-319558F77B8B}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{1E154E4A-622B-44BB-9F63-319558F77B8B}\{31953E58-32D6-4EB7-B1F1-3AE242AA542B} = 4cc63b15	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{778737FA-1487-4AE0-92C8-0D682CF36CC0}\#cert = 31	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{778737FA-1487-4AE0-92C8-0D682CF36CC0}	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid process

1600 01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid	process
1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exeExplorer.EXE

description	pid	process
Token: SeCreateGlobalPrivilege	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Token: SeDebugPrivilege	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
Token: SeCreateGlobalPrivilege	1380	Explorer.EXE
Token: SeShutdownPrivilege	1380	Explorer.EXE
Token: SeDebugPrivilege	1380	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid process

1600 01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

pid	process
1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe

description	pid	process	target process
PID 1600 wrote to memory of 304	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	spoolsv.exe
PID 1600 wrote to memory of 304	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	spoolsv.exe
PID 1600 wrote to memory of 1380	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	Explorer.EXE
PID 1600 wrote to memory of 1380	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	Explorer.EXE
PID 1600 wrote to memory of 1620	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	sppsvc.exe
PID 1600 wrote to memory of 1620	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	sppsvc.exe
PID 1600 wrote to memory of 2028	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	WMIADAP.EXE
PID 1600 wrote to memory of 2028	1600	01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe	WMIADAP.EXE

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1620

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2028

C:\Users\Admin\AppData\Local\Temp\01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe
"C:\Users\Admin\AppData\Local\Temp\01f31bef96b043b2cccfe1c607497f3fac0b4c70273e74d929469d6727b7b906.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\XupiXnewh\XupiXnewh.dat

Filesize
244KB

MD5
3e08e4b00038a9c13c7766ebfb95e7ad

SHA1
8d792c6b920e7010be7cfebef97ee4a84bbbb990

SHA256
bf72f59a46e2a264887e9d0cbc3bd24a285bd8985065d8ddee13515102dae7d1

SHA512
24fd08b1f56f45c691f0fe6a928483d82d61f18837f4b6f4ee8bc5d879430091227e23e5ed9f6a6b6c22bc601ebd1497b5f7533a83952d1dcd7e2ad640b6bfdf

Download Submit
\ProgramData\XupiXnewh\XupiXnewh.dat

Filesize
244KB

MD5
3e08e4b00038a9c13c7766ebfb95e7ad

SHA1
8d792c6b920e7010be7cfebef97ee4a84bbbb990

SHA256
bf72f59a46e2a264887e9d0cbc3bd24a285bd8985065d8ddee13515102dae7d1

SHA512
24fd08b1f56f45c691f0fe6a928483d82d61f18837f4b6f4ee8bc5d879430091227e23e5ed9f6a6b6c22bc601ebd1497b5f7533a83952d1dcd7e2ad640b6bfdf

Download Submit
memory/304-61-0x0000000001CA0000-0x0000000001CF4000-memory.dmp

Filesize
336KB

Download
memory/1380-74-0x0000000002A80000-0x0000000002AEB000-memory.dmp

Filesize
428KB

Download
memory/1380-66-0x0000000002700000-0x0000000002754000-memory.dmp

Filesize
336KB

Download
memory/1600-59-0x00000000750E0000-0x0000000075113000-memory.dmp

Filesize
204KB

Download
memory/1600-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-65-0x00000000750E0000-0x0000000075146000-memory.dmp

Filesize
408KB

Download
memory/1600-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1600-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1600-75-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-76-0x00000000750E0000-0x0000000075113000-memory.dmp

Filesize
204KB

Download
memory/1600-77-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads