ed016488b3993557bb6e1b8b47e14dbceb4989a253151c17cd5e1eaca3b51e25

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae11634979acedcd90fb798bdbb31705.exe
Size

196KB
MD5

ae11634979acedcd90fb798bdbb31705
SHA1

f55b92e74a3c4e66a57694732639dca00c9bccd4
SHA256

ed016488b3993557bb6e1b8b47e14dbceb4989a253151c17cd5e1eaca3b51e25
SHA512

6a85b8ed8bd35a74fce7f0e323e2e909fa432e7f75e43bdb1b7ddf5ced9fbfd9b34230349f9c92bc8ea20442672f6c5fcbb44b489ef116c6037755066f47188a
SSDEEP

6144:cF6+27WAZZzxLNpilMH8HI0kO1ybka7RdwuZ0:WlAZZ7pZr7dwC0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4996	xjewow.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\txjew\\command	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\txjew	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\txjew	xjewow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	xjewow.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2200	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1612	2424	ae11634979acedcd90fb798bdbb31705.exe	89
PID 2424 wrote to memory of 1612	2424	ae11634979acedcd90fb798bdbb31705.exe	89
PID 2424 wrote to memory of 1612	2424	ae11634979acedcd90fb798bdbb31705.exe	89
PID 1612 wrote to memory of 4996	1612	cmd.exe	91
PID 1612 wrote to memory of 4996	1612	cmd.exe	91
PID 1612 wrote to memory of 4996	1612	cmd.exe	91
PID 1612 wrote to memory of 2200	1612	cmd.exe	92
PID 1612 wrote to memory of 2200	1612	cmd.exe	92
PID 1612 wrote to memory of 2200	1612	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\ae11634979acedcd90fb798bdbb31705.exe
"C:\Users\Admin\AppData\Local\Temp\ae11634979acedcd90fb798bdbb31705.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\lylxcvf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\xjewow.exe
    "C:\Users\Admin\AppData\Local\Temp\xjewow.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4996
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lylxcvf.bat

Filesize
124B

MD5
a88979cbe8bd868e07e95b5088042afc

SHA1
fd1944a1b1d2bf0354461b2de41b535f9ee0d76a

SHA256
77da836748c0e6ee125a3b7c2c455c05b3d9654eda7a3a2dc19315f356d91af3

SHA512
16198825a6e0fd3f006caaba621b4ab32ea3d417f6a0d5cdf91c7af2c496e20c8031864e14cb1077704c2d3c9831c9b6face236656ab987418230658f9cfd967

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjewow.exe

Filesize
148KB

MD5
edc9e7214eaad54f124d974dfb6a37f2

SHA1
1f2a99caf7d909cc0c302118c828c83028739157

SHA256
924cbc8d8622800197de670ed50bb8fb9f91fb5ba98c758fab96c2c57601580f

SHA512
5eb976becfae281769599c784bbf301d303a5491f6c9e57ab2dbfc3f916dba6567d028a02e5616d0d701f22aa49114264ec22756e02301ed0d1a6ca327fa086a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zouaxr.bat

Filesize
156B

MD5
ea017ce32f116c58182106323aeeda2d

SHA1
08f42a8b34028df292e1fa577f3ec9e0245948e7

SHA256
6fed21d8246d31b243c35f88e2b15463f5b386da63d8def75eb9e321d434a5f0

SHA512
caa08b897dcb3267cd41cfe59d2e3715f0b656ed2fb43ef102e0f0b1499c8e2742c04c46975338595b435ba08936249c192c3fa2b214afa057fdfb4b01dff639

Download Submit