c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539

General

Target

c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
Size

92KB
MD5

33e3bbcf9b34c8cecb5279eec1d644e0
SHA1

db62be5aeaf66691da1627a419d935ab58c67940
SHA256

c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539
SHA512

eb1faf6aca854b8747e433fe756a1d0aef1a66e2d6a1a18ab8ee5da68fc30556087a065cf732120d09a03dba2fb9bec24c95215115592cb93eee336861801b1b
SSDEEP

1536:3YSSR+XyVoizrqkhSJ7p7bi/KveY4x5EPQJUnRSuvy0ORU5kgB:pSVaQrqkI97biTxSPMUnRt67Ckc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xoirioy.exe

Executes dropped EXE 2 IoCs

pid	Process
2616	xoirioy.exe
1224	xoirioy.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoirioy = "C:\\Users\\Admin\\xoirioy.exe /l"	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	xoirioy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoirioy = "C:\\Users\\Admin\\xoirioy.exe /d"	xoirioy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	xoirioy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	xoirioy.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\c\autorun.inf	xoirioy.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 2616 set thread context of 1224	2616	xoirioy.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
1224	xoirioy.exe
1224	xoirioy.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
2616	xoirioy.exe
1224	xoirioy.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 1336 wrote to memory of 936	1336	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	78
PID 936 wrote to memory of 2616	936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	80
PID 936 wrote to memory of 2616	936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	80
PID 936 wrote to memory of 2616	936	c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe	80
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81
PID 2616 wrote to memory of 1224	2616	xoirioy.exe	81

C:\Users\Admin\AppData\Local\Temp\c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
"C:\Users\Admin\AppData\Local\Temp\c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539.exe
  071
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\xoirioy.exe
    "C:\Users\Admin\xoirioy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\xoirioy.exe
      071
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Maps connected drives based on registry
      Drops autorun.inf file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\xoirioy.exe

Filesize
92KB

MD5
33e3bbcf9b34c8cecb5279eec1d644e0

SHA1
db62be5aeaf66691da1627a419d935ab58c67940

SHA256
c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539

SHA512
eb1faf6aca854b8747e433fe756a1d0aef1a66e2d6a1a18ab8ee5da68fc30556087a065cf732120d09a03dba2fb9bec24c95215115592cb93eee336861801b1b

Download Submit
C:\Users\Admin\xoirioy.exe

Filesize
92KB

MD5
33e3bbcf9b34c8cecb5279eec1d644e0

SHA1
db62be5aeaf66691da1627a419d935ab58c67940

SHA256
c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539

SHA512
eb1faf6aca854b8747e433fe756a1d0aef1a66e2d6a1a18ab8ee5da68fc30556087a065cf732120d09a03dba2fb9bec24c95215115592cb93eee336861801b1b

Download Submit
C:\Users\Admin\xoirioy.exe

Filesize
92KB

MD5
33e3bbcf9b34c8cecb5279eec1d644e0

SHA1
db62be5aeaf66691da1627a419d935ab58c67940

SHA256
c77284987a90f51382df387f35b0780ff16b7e71230926a91caea9b5e955f539

SHA512
eb1faf6aca854b8747e433fe756a1d0aef1a66e2d6a1a18ab8ee5da68fc30556087a065cf732120d09a03dba2fb9bec24c95215115592cb93eee336861801b1b

Download Submit
memory/936-135-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/936-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/936-140-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/936-141-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1224-154-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1224-155-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads