4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17

General

Target

4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
Size

2.4MB
MD5

b45bdb461239e2196a8829446bce6e2a
SHA1

2e5fa64ae96131c37e57a48f337180a3051e6ef0
SHA256

4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17
SHA512

86311c50ad7d9ca5943c2ed2f5526b77e95788840b699277ab6001b1fade240e8dad442b574dee2b7febb8d272d4269deed573d75abd5d121c8062ad97731bcb
SSDEEP

49152:n0kWWQeTfuTzeLV9amkf4OSq2CAMuxktsFbi65FFy45rjSAQAr1Wgc2Im:0kWWhTfumLzaNj523Mux9biqy4tS1rQ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\usbfree.sys	XCFaXian.exe
File opened for modification	C:\Windows\System32\Drivers\usbfree.sys	XCFaXian.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	XCFaXian.exe
4172	XCFaXian.exe

Loads dropped DLL 1 IoCs

pid	Process
4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\XCFaXian\Ð¡³¿·¢ÏÖ.lnk	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\XCFaXian.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\AdbWinUsbApi.dll	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\AdbWinApi.dll	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\adb.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\x64\usbfree.sys	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\xcfn.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\usbfree.sys	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
File created	C:\Program Files (x86)\XCFaXian\uninst.exe	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nvse.dat	XCFaXian.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	XCFaXian.exe
1120	XCFaXian.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4172	XCFaXian.exe
4172	XCFaXian.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4172	XCFaXian.exe
4172	XCFaXian.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1120	XCFaXian.exe
4172	XCFaXian.exe
4172	XCFaXian.exe
4172	XCFaXian.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1120	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	82
PID 4104 wrote to memory of 1120	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	82
PID 4104 wrote to memory of 1120	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	82
PID 4104 wrote to memory of 4172	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	83
PID 4104 wrote to memory of 4172	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	83
PID 4104 wrote to memory of 4172	4104	4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe	83

C:\Users\Admin\AppData\Local\Temp\4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe
"C:\Users\Admin\AppData\Local\Temp\4d043a2252566849f09ce116971c70b5c721d012343601c1e8f0f30597aa0f17.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\nsf52F3.tmp\XCFaXian.exe
  C:\Users\Admin\AppData\Local\Temp\nsf52F3.tmp\XCFaXian.exe /fix
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1120
- C:\Program Files (x86)\XCFaXian\XCFaXian.exe
  "C:\Program Files (x86)\XCFaXian\XCFaXian.exe" /A
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Program Files (x86)\XCFaXian\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Program Files (x86)\XCFaXian\x64\usbfree.sys

Filesize
384KB

MD5
7661971ab34d2e4d80e44c3e9f82d66a

SHA1
2de3fe80d57d89dec0370b82f5abf955dd182ae4

SHA256
cef69dae237e973c608624af2daba84f70d0babb1bdaafab20956e62188cb539

SHA512
5b963b16d441ab161ec4d82c558632e9936b9fd4f848d6a68b0108e874e2690a98901e5fd936911fbe63f87d4eb5ec3d1dbc576f400e5de5c5fae90b9449f2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf52F3.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf52F3.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf52F3.tmp\XCFaXian.exe

Filesize
2.4MB

MD5
c10eb8171651db7a1bf568381c3f50b7

SHA1
bfeb6d143aa5a9947a2ac33fc2d91f6882b89b0b

SHA256
d1910ce92cf14641c3286bb3cd1342e7ed07325d28dbca447ec06a173a966d49

SHA512
024b09be70049729eb8b668cf0e84979b70bfb7ec04d376182c6260d0da5da27a1b20c391dbabfd53ab0b118bb4461a574fc7fe178207f1586b084b316f295ab

Download Submit
memory/1120-133-0x0000000000000000-mapping.dmp

Download
memory/4172-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing