Analysis
-
max time kernel
153s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 21:05
Static task
static1
Behavioral task
behavioral1
Sample
6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe
-
Size
60KB
-
MD5
44ab314d5404e78d466e1833fc668a4d
-
SHA1
d2ae74e4244042dac9c6eff209f6a9b835159cad
-
SHA256
6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f
-
SHA512
588e9e2cb17897226819fb81e9b70ff1d7e68e9026b550c6d0ff414843f32ffeb6b6326ca9d6c202335c99d65e5f2d170572e67cfcfe6b02a62996d920adae9e
-
SSDEEP
768:pX8x1BAKpa1tb1s+W2D2n/z/D0lbdfs3OfKDHGqHg6WBY:pX0RaY2a/Dxg6WBY
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mxsioz.exe -
Executes dropped EXE 1 IoCs
pid Process 1748 mxsioz.exe -
Loads dropped DLL 2 IoCs
pid Process 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ mxsioz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\mxsioz = "C:\\Users\\Admin\\mxsioz.exe" mxsioz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe 1748 mxsioz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 1748 mxsioz.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1748 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 27 PID 1620 wrote to memory of 1748 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 27 PID 1620 wrote to memory of 1748 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 27 PID 1620 wrote to memory of 1748 1620 6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe 27 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13 PID 1748 wrote to memory of 1620 1748 mxsioz.exe 13
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe"C:\Users\Admin\AppData\Local\Temp\6ef5f9c6724bec54aac6b53a2c0b30ba56e84072d3c9e0bcfe589e4a6389be8f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\mxsioz.exe"C:\Users\Admin\mxsioz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD585cc5e269543d44f95ac62b75c0712b6
SHA17c3bb21f504dfa0a13a106a3ca445ded51e6cb16
SHA2562521c1e57499f753e761ff7a20b04d43e34159893fd76b0550b4bf0d68638c90
SHA5127820999df93ed411b8b97e05523ed5f6255c0da7d5c92d4e3943fa8d8faeca67770b530f83dfe643f9ae23ce093fba5ab3c7895d0a8be069607d646f0970a7cc
-
Filesize
60KB
MD585cc5e269543d44f95ac62b75c0712b6
SHA17c3bb21f504dfa0a13a106a3ca445ded51e6cb16
SHA2562521c1e57499f753e761ff7a20b04d43e34159893fd76b0550b4bf0d68638c90
SHA5127820999df93ed411b8b97e05523ed5f6255c0da7d5c92d4e3943fa8d8faeca67770b530f83dfe643f9ae23ce093fba5ab3c7895d0a8be069607d646f0970a7cc
-
Filesize
60KB
MD585cc5e269543d44f95ac62b75c0712b6
SHA17c3bb21f504dfa0a13a106a3ca445ded51e6cb16
SHA2562521c1e57499f753e761ff7a20b04d43e34159893fd76b0550b4bf0d68638c90
SHA5127820999df93ed411b8b97e05523ed5f6255c0da7d5c92d4e3943fa8d8faeca67770b530f83dfe643f9ae23ce093fba5ab3c7895d0a8be069607d646f0970a7cc
-
Filesize
60KB
MD585cc5e269543d44f95ac62b75c0712b6
SHA17c3bb21f504dfa0a13a106a3ca445ded51e6cb16
SHA2562521c1e57499f753e761ff7a20b04d43e34159893fd76b0550b4bf0d68638c90
SHA5127820999df93ed411b8b97e05523ed5f6255c0da7d5c92d4e3943fa8d8faeca67770b530f83dfe643f9ae23ce093fba5ab3c7895d0a8be069607d646f0970a7cc