Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 09:49
Behavioral task
behavioral1
Sample
virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe
- Size 576KB
- Sample240303-ltk2nshb93
- SHA256 81cb6823a9b8c8df24395fd4f0ed6ccff0e7de8ca24f8fb307bb64ed7ecedd1c
- MD5 95ff938df3790aff3f746c3ecf2db9be
- SHA1 3d201b6096d6b85015ba467a6954307d66bd498d
- SHA512 ac3d376dd4ac4014edb43a75f9696ae239a69b7bad605283f3bf2fb23183464019ecd61d20170b65de82dbd0186ebbe5f9f303dc48c4944e157301bb6be7f407
- SSDEEP 6144:udspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70Nq:k8kxNhOZElO5kkWjhD4AWWB5lG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3236 XNQ.EXE - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\XRNVD.EXE \"%1\" %*" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe -
resource yara_rule behavioral2/memory/1640-0-0x0000000000400000-0x000000000047A000-memory.dmp upx behavioral2/files/0x000100000000002a-10.dat upx behavioral2/files/0x000800000002322b-21.dat upx behavioral2/memory/3236-24-0x0000000000400000-0x000000000047A000-memory.dmp upx behavioral2/memory/1640-25-0x0000000000400000-0x000000000047A000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XRNVD.EXE = "C:\\Program Files (x86)\\XRNVD.EXE" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe - Enumerates connected drives 3 TTPs 34 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: XNQ.EXE File opened (read-only) \??\J: XNQ.EXE File opened (read-only) \??\K: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\T: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\E: XNQ.EXE File opened (read-only) \??\M: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\K: XNQ.EXE File opened (read-only) \??\Q: XNQ.EXE File opened (read-only) \??\G: XNQ.EXE File opened (read-only) \??\O: XNQ.EXE File opened (read-only) \??\R: XNQ.EXE File opened (read-only) \??\G: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\P: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\U: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\U: XNQ.EXE File opened (read-only) \??\V: XNQ.EXE File opened (read-only) \??\V: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\L: XNQ.EXE File opened (read-only) \??\T: XNQ.EXE File opened (read-only) \??\M: XNQ.EXE File opened (read-only) \??\E: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\H: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\L: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\O: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\Q: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\R: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\S: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\H: XNQ.EXE File opened (read-only) \??\I: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\J: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\N: virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened (read-only) \??\N: XNQ.EXE File opened (read-only) \??\P: XNQ.EXE File opened (read-only) \??\S: XNQ.EXE - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\XRNVD.EXE virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File created C:\Program Files (x86)\ECJLC.EXE virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File opened for modification C:\Program Files (x86)\ECJLC.EXE virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe File created C:\Program Files (x86)\XRNVD.EXE virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ASPPJA.EXE XNQ.EXE - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "F:\\$RECYCLE.BIN\\PFKLUZO.EXE %1" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open XNQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files (x86)\\ECJLC.EXE %1" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command XNQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "F:\\$RECYCLE.BIN\\PFKLUZO.EXE \"%1\"" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\XRNVD.EXE \"%1\" %*" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "F:\\$RECYCLE.BIN\\PFKLUZO.EXE \"%1\"" virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell XNQ.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command XNQ.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1640 wrote to memory of 3236 1640 virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe 95 PID 1640 wrote to memory of 3236 1640 virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe 95 PID 1640 wrote to memory of 3236 1640 virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_95ff938df3790aff3f746c3ecf2db9be.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\$Recycle.Bin\XNQ.EXEC:\$Recycle.Bin\XNQ.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:4784
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\XNQ.EXE
- Size 576KB
- SHA256 8a638b0721a03659646d49f21694e7d7fe4fd75179140c128537c233deddbea2
- MD5 00c47b776f472c7c5b19d2355ca15b62
- SHA1 96e389bbbcc3d871b9bd3d6cbf72684756ffd557
- SHA512 5abb447ea7dc08c4a31ddc5dd33384dd720906cfd1f809545b6eb393ff51438f3fc511dfe3aa29a10228ee2b1afdc4f39094ceda553ba8778f893b128c967557
- SSDEEP 6144:udspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70Nq:k8kxNhOZElO5kkWjhD4AWWB5lG
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\PFKLUZO.EXE
- Size 496KB
- SHA256 fafe385ffc2e812dba001ce8a9ad31d1cd2319d42f9c89ababa342df5f6dd694
- MD5 9e359d35552aa1375de88f5afa463e7d
- SHA1 ccf3347e2691e044f2d91e0c6af884545f32f535
- SHA512 eec90705e6f075fab694c943a640a5d7692be7ab558438ec626629010c26a61db1ddbf728fbe204186ff3a218b5d9e0aba960bb73d879de8e4b71440e82fae8e
- SSDEEP 6144:udspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70Nq:k8kxNhOZElO5kkWjhD4AWWB5lG
- MD5 SHA1 SHA512 SSDEEP