Analysis
-
max time kernel
203s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 09:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6384c77011929f08660f14c72f762527.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6384c77011929f08660f14c72f762527.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6384c77011929f08660f14c72f762527.exe
-
Size
244KB
-
MD5
6384c77011929f08660f14c72f762527
-
SHA1
163e2c4dee6c3d2d4c0cc42be0ed9013ad0a789e
-
SHA256
4a1e1149116c1ff68358a2c8c804bda2055d0b9adba08c2f2558e2aefe3ac78c
-
SHA512
dcdebc10da30cac2bb3952d6f942cf0b86ea568b5a040ce8748e09ac4f705f32e86a0cb6b395bec7d6b9b003981d98c56a082472c417b8d02e3899c3cda5d45c
-
SSDEEP
3072:7hPBdBsROnFQroR5yIuSP9lqVinU3bp/PTm2moJ6BwA+GABMndgSqrr:7hJdV7PnqVinU3bw2moJ6WAdgB3
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6384c77011929f08660f14c72f762527.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiror.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 6384c77011929f08660f14c72f762527.exe -
Executes dropped EXE 1 IoCs
pid Process 4524 xiror.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /y" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /v" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /c" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /h" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /o" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /w" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /d" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /v" 6384c77011929f08660f14c72f762527.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /j" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /g" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /b" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /f" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /t" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /p" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /n" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /s" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /x" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /m" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /z" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /e" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /k" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /a" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /u" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /i" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /l" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /q" xiror.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiror = "C:\\Users\\Admin\\xiror.exe /r" xiror.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4552 6384c77011929f08660f14c72f762527.exe 4552 6384c77011929f08660f14c72f762527.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe 4524 xiror.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4552 6384c77011929f08660f14c72f762527.exe 4524 xiror.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4524 4552 6384c77011929f08660f14c72f762527.exe 96 PID 4552 wrote to memory of 4524 4552 6384c77011929f08660f14c72f762527.exe 96 PID 4552 wrote to memory of 4524 4552 6384c77011929f08660f14c72f762527.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6384c77011929f08660f14c72f762527.exe"C:\Users\Admin\AppData\Local\Temp\6384c77011929f08660f14c72f762527.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\xiror.exe"C:\Users\Admin\xiror.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD5a2119b0e7332ca8d43baaf7b4eb0f124
SHA1f2044f9a7177ce614900e5aa1211ccafb0941c8c
SHA2563f3ba7f0b2d93fbfc06a5b0015a9233202e84ebe917bf2cd9da518e220ac6ed1
SHA512210f3cb55c9819ccae02a6e4b29d44ea874782ca0d186cf96e98a12c38d565cbb5324e9a3ad8a926e1becab4470433fe9fb22ed46d8dca3e5c25f358f56c4847