Analysis
-
max time kernel
140s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:14
Behavioral task
behavioral1
Sample
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe
Resource
win7-20221111-en
General
-
Target
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe
-
Size
138KB
-
MD5
c5d0ae675627de0a43f710eae9612549
-
SHA1
62b995c6dfe5500e02084cca30411362a0ab3ca5
-
SHA256
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8
-
SHA512
fff07b8e1def5b2b2168447d4f8811d27944b259ddd406ce56b7e230db16ffa759f81e5ec2facc0618a3ffe84e7a2a26dfffe894f417e68c3e34d1ab0aac1313
-
SSDEEP
3072:3qrvRknb6sxBl0E+R+Bch+l5wJGVTa/pvfM7RCpGZ:a7RcZt9IF6uJkeEv
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
xiantexture.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat xiantexture.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
xiantexture.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-af-80-f3-f0-62\WpadDecisionTime = 10ade01e1634d901 xiantexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xiantexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B}\WpadDecisionTime = 10ade01e1634d901 xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B}\26-af-80-f3-f0-62 xiantexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" xiantexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B} xiantexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B}\WpadDecision = "0" xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-af-80-f3-f0-62 xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections xiantexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings xiantexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B}\WpadNetworkName = "Network 2" xiantexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-af-80-f3-f0-62\WpadDecisionReason = "1" xiantexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-af-80-f3-f0-62\WpadDecision = "0" xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings xiantexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix xiantexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad xiantexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 xiantexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" xiantexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E0ED838-B54F-417D-97E8-C81703E8C97B}\WpadDecisionReason = "1" xiantexture.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
xiantexture.exepid process 432 xiantexture.exe 432 xiantexture.exe 432 xiantexture.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exepid process 1420 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exexiantexture.exexiantexture.exepid process 1776 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 1420 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 316 xiantexture.exe 432 xiantexture.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exexiantexture.exedescription pid process target process PID 1776 wrote to memory of 1420 1776 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe PID 1776 wrote to memory of 1420 1776 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe PID 1776 wrote to memory of 1420 1776 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe PID 1776 wrote to memory of 1420 1776 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe 989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe PID 316 wrote to memory of 432 316 xiantexture.exe xiantexture.exe PID 316 wrote to memory of 432 316 xiantexture.exe xiantexture.exe PID 316 wrote to memory of 432 316 xiantexture.exe xiantexture.exe PID 316 wrote to memory of 432 316 xiantexture.exe xiantexture.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe"C:\Users\Admin\AppData\Local\Temp\989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\989cd7cd06b1de240a9b00cb2bced5bf736100e94d9adb63710d7493d229c3b8.exe--9e3099f72⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\xiantexture.exe"C:\Windows\SysWOW64\xiantexture.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xiantexture.exe--7d4180332⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-60-0x0000000000000000-mapping.dmp
-
memory/432-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/432-64-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1420-55-0x0000000000000000-mapping.dmp
-
memory/1420-58-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1420-59-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1420-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1776-54-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1776-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1776-57-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB