Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30ecfb627f65a8e5571983de5212b2e9.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
30ecfb627f65a8e5571983de5212b2e9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
30ecfb627f65a8e5571983de5212b2e9.exe
-
Size
236KB
-
MD5
30ecfb627f65a8e5571983de5212b2e9
-
SHA1
b2cba84ab364954388aaaa4f0391bbe5f8c4f7f8
-
SHA256
20de8b14f3275bc17c519a9ff0845b5d116229fecc5c269f31634696a2064ebf
-
SHA512
732a976cc4fb03d1e108ecdc9c0300d111b0515627ac2369ce4a96d288db6b36eb4b963bbad5bd4c74760f22852edc48a539c0d78515296c03f8ccc41373682a
-
SSDEEP
6144:3wbPxAjjLPqKGaLCUI989H79t5LqRPqTmc4t2GXh+juOTXFbx:AbPxAjjLPqKGaLCUI989H79t4lqV4tet
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 30ecfb627f65a8e5571983de5212b2e9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeeebe.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 30ecfb627f65a8e5571983de5212b2e9.exe -
Executes dropped EXE 1 IoCs
pid Process 3992 xeeebe.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /p" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /S" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /g" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /U" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /x" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /u" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /r" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /C" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /s" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /c" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /Z" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /L" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /w" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /y" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /D" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /J" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /a" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /Y" 30ecfb627f65a8e5571983de5212b2e9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /P" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /t" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /h" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /B" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /l" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /Q" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /I" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /W" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /N" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /d" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /b" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /H" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /o" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /m" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /V" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /R" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /O" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /M" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /k" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /j" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /i" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /X" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /T" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /K" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /z" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /q" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /v" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /A" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /G" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /E" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /Y" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /n" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /F" xeeebe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeeebe = "C:\\Users\\Admin\\xeeebe.exe /e" xeeebe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 30ecfb627f65a8e5571983de5212b2e9.exe 4836 30ecfb627f65a8e5571983de5212b2e9.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe 3992 xeeebe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4836 30ecfb627f65a8e5571983de5212b2e9.exe 3992 xeeebe.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3992 4836 30ecfb627f65a8e5571983de5212b2e9.exe 92 PID 4836 wrote to memory of 3992 4836 30ecfb627f65a8e5571983de5212b2e9.exe 92 PID 4836 wrote to memory of 3992 4836 30ecfb627f65a8e5571983de5212b2e9.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\30ecfb627f65a8e5571983de5212b2e9.exe"C:\Users\Admin\AppData\Local\Temp\30ecfb627f65a8e5571983de5212b2e9.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\xeeebe.exe"C:\Users\Admin\xeeebe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5a25115d7eb1b7dc7b3aa4d17360d7e35
SHA18940d81f99e7f5c3626bc91d978b5fa1c2afa5da
SHA25699ddd4138e5d4b39f9d023447d62b37dac591f57da005a64b1b01ae323996173
SHA5126d1eac6e31b290d702d7934ee559c8f4506e2e803009de9b0d74b5b3f313c79929ba2f7caef7f63ad5bc99561f45419098ec17804870293f852f9935e51431e9