c26c03a5660c434db6aa9522025e0ed81d5abaa617537066fba04871b7532d56

Analysis

max time kernel
156s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e73c078e8056c7dad6945dbbc49a626.exe
Size

500KB
MD5

1e73c078e8056c7dad6945dbbc49a626
SHA1

bf19380757a3a6c00b1275aa32bd3f76c11cea1f
SHA256

c26c03a5660c434db6aa9522025e0ed81d5abaa617537066fba04871b7532d56
SHA512

bbc85d5eefc7ff5f2b91c0fe3c425e3f6f77c51ecb6b455c8f6c4f582e2d1e6faa26eb52959e481dc4ccfd1b1c763aaa0b1fdb345f89c00c36a49b672d558494
SSDEEP

12288:Rbe+DImBecm5G9FhIIEYtSogeYg6XoKQe4oDNLmS6vSHuyoumYH:RMSHjfPXtSoioKQeHL6vk3

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xpcxxi\Parameters\ServiceDll = "%SystemRoot%\\System32\\xpcxxi.dll"	1e73c078e8056c7dad6945dbbc49a626.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\xpcxxi\Parameters\ServiceDll = "%SystemRoot%\\System32\\xpcxxi.dll"	1e73c078e8056c7dad6945dbbc49a626.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\xpcxxi\Parameters\ServiceDll = "%SystemRoot%\\System32\\xpcxxi.dll"	1e73c078e8056c7dad6945dbbc49a626.exe

Loads dropped DLL 2 IoCs

pid	Process
2464	1e73c078e8056c7dad6945dbbc49a626.exe
3520	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpcxxi.dll	1e73c078e8056c7dad6945dbbc49a626.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2444	3520	WerFault.exe	92
1144	3520	WerFault.exe	92

C:\Users\Admin\AppData\Local\Temp\1e73c078e8056c7dad6945dbbc49a626.exe
"C:\Users\Admin\AppData\Local\Temp\1e73c078e8056c7dad6945dbbc49a626.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3520 -ip 3520
1⤵
PID:3608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k xpcxxi
1⤵
- Loads dropped DLL
PID:3520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 512
  2⤵
  - Program crash
  PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 568
  2⤵
  - Program crash
  PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3520 -ip 3520
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xpcxxi.dll

Filesize
376KB

MD5
535609d79759c33207e1cdf64b8b3821

SHA1
7b131b0038d9d9abc7f04328812d322ad168995c

SHA256
b1e7ff0a8844e7d119568bf5f66f8855bb0858a263bbe8e0b9f1f5dad47ec867

SHA512
34caf191eb8ab8d9c8cd09435aacdac3bbe92e87fb61f89b23e8008ea137d51ecedca324c0b5c49a13fca1e538079f8b9c2f2ffadc080fbbbe19a863187db9e3

Download Submit
C:\Windows\SysWOW64\xpcxxi.dll

Filesize
208KB

MD5
ab06ce23db1ff94ef1412dc20ea43444

SHA1
84f58844bcd27cd0f4668551258e0928c317df44

SHA256
e88e6ee9a1b88847cd71b69731a8f31c94c96a4979de394331c3cfeb2c288c7b

SHA512
f3499f4b1892891888af4eeaac7354aaa28c87b3eebfdb2ab0fc3fa27c6ae4cebd998c9bde28e6fc0b4ae1c9280c1923e37ecde95ef3b15fb4c31678278e39fa

Download Submit
\??\c:\windows\SysWOW64\xpcxxi.dll

Filesize
288KB

MD5
741a3e1b704ce2348e0ccf07f833e58a

SHA1
3c6c54675e23beab8c705f3ac77ebcc11a479a8d

SHA256
fa3a2c9700828e6e74d3a1245306297f4b228fe9ec4c7b7755299b92e3ceac9f

SHA512
005f9d2a32abdefaf4bf3386b544144834e3f031551f9224fe78f3dcdf6a5b4bab18ed27fec26435fdbc137acba0f6c6a63034e81fcbed294760e742d2c3f714

Download Submit
memory/2464-10-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2464-9-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2464-5-0x0000000002370000-0x00000000023C4000-memory.dmp

Filesize
336KB

Download
memory/2464-19-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/2464-25-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/2464-6-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2464-20-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/2464-2-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/2464-15-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/2464-14-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2464-13-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2464-12-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2464-11-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2464-16-0x00000000034E0000-0x00000000034E5000-memory.dmp

Filesize
20KB

Download
memory/2464-8-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2464-7-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3520-21-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/3520-22-0x00000000016F0000-0x0000000001744000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads