4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17

Analysis

max time kernel
72s
max time network
76s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
Size

2.4MB
MD5

b45bdb461239e2196a8829446bce6e2a
SHA1

2e5fa64ae96131c37e57a48f337180a3051e6ef0
SHA256

4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17
SHA512

86311c50ad7d9ca5943c2ed2f5526b77e95788840b699277ab6001b1fade240e8dad442b574dee2b7febb8d272d4269deed573d75abd5d121c8062ad97731bcb
SSDEEP

49152:n0kWWQeTfuTzeLV9amkf4OSq2CAMuxktsFbi65FFy45rjSAQAr1Wgc2Im:0kWWhTfumLzaNj523Mux9biqy4tS1rQ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\usbfree.sys	XCFaXian.exe
File opened for modification	C:\Windows\System32\Drivers\usbfree.sys	XCFaXian.exe

Executes dropped EXE 2 IoCs

pid	Process
1804	XCFaXian.exe
2008	XCFaXian.exe

Loads dropped DLL 11 IoCs

pid	Process
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
1804	XCFaXian.exe
1804	XCFaXian.exe
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
2008	XCFaXian.exe
2008	XCFaXian.exe
2008	XCFaXian.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\XCFaXian\uninst.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\Ð¡³¿·¢ÏÖ.lnk	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\xcfn.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\AdbWinUsbApi.dll	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\usbfree.sys	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\x64\usbfree.sys	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\XCFaXian.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\AdbWinApi.dll	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\adb.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nvse.dat	XCFaXian.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000014371-65.dat	nsis_installer_1
behavioral1/files/0x0006000000014371-65.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	XCFaXian.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	XCFaXian.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2008	XCFaXian.exe
2008	XCFaXian.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2008	XCFaXian.exe
2008	XCFaXian.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1804	XCFaXian.exe
2008	XCFaXian.exe
2008	XCFaXian.exe
2008	XCFaXian.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 1804	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	27
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28
PID 1948 wrote to memory of 2008	1948	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	28

C:\Users\Admin\AppData\Local\Temp\4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
"C:\Users\Admin\AppData\Local\Temp\4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe
  C:\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe /fix
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1804
- C:\Program Files (x86)\XCFaXian\XCFaXian.exe
  "C:\Program Files (x86)\XCFaXian\XCFaXian.exe" /A
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Program Files (x86)\XCFaXian\x64\usbfree.sys

Filesize
384KB

MD5
7661971ab34d2e4d80e44c3e9f82d66a

SHA1
2de3fe80d57d89dec0370b82f5abf955dd182ae4

SHA256
cef69dae237e973c608624af2daba84f70d0babb1bdaafab20956e62188cb539

SHA512
5b963b16d441ab161ec4d82c558632e9936b9fd4f848d6a68b0108e874e2690a98901e5fd936911fbe63f87d4eb5ec3d1dbc576f400e5de5c5fae90b9449f2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Program Files (x86)\XCFaXian\uninst.exe

Filesize
58KB

MD5
fac275f000f75fa0785bbf5a32d1b1b1

SHA1
05914c5407329fc1fc4ed50465247bb93523a3d5

SHA256
6c06bb7e75d4c79209154626651aaa03b72d685bd70edb9f8d421f65f97d669e

SHA512
3e4b3e3ab809c8b229f40caf31151419a43f5d6a20fd7530c2a3472639714ced3041a83e2b3ed48d10b10d17c9ff323ab78c50388b4f733488ed3b44b22f4621

Download Submit
\Users\Admin\AppData\Local\Temp\nso1C59.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
\Users\Admin\AppData\Local\Temp\nso1C59.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
memory/1948-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download