Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe
-
Size
164KB
-
MD5
5fe9bf3c4c905781a9f7ab8482249b93
-
SHA1
6229226d54ee67bc5259a31d0018054d1a33937a
-
SHA256
55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7
-
SHA512
fe134fe84286843597abb3409d8b7e6553a28191b00d1c09bfe2d77163c8cbb99bf381ad184b52ed9db3c9f180e78769706cf8acbb925bf6327fb89b5228177f
-
SSDEEP
3072:77VzLvWEbV93WZy844f6G06r7bkcsN2bnldN:77FTbOQof6Gn7bkjKld
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xemox.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe -
Executes dropped EXE 1 IoCs
pid Process 5068 xemox.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /r" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /a" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /o" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /t" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /c" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /i" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /v" 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /k" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /v" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /h" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /j" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /q" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /l" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /u" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /f" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /s" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /e" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /m" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /n" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /w" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /b" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /g" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /y" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /z" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /p" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /x" xemox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xemox = "C:\\Users\\Admin\\xemox.exe /d" xemox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe 5068 xemox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 5068 xemox.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4580 wrote to memory of 5068 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 93 PID 4580 wrote to memory of 5068 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 93 PID 4580 wrote to memory of 5068 4580 55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe"C:\Users\Admin\AppData\Local\Temp\55cf5df0041e7831b4c30fccaee7dd92027f047764bfa10192e7ccde1e7a2cb7.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\xemox.exe"C:\Users\Admin\xemox.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5ded09bab98029bd6c823f82aa83e41d5
SHA10fb70a08febcb65fe89333933a4bef5d355e07be
SHA2569078d91dea4945cb65b55dfc788dcd5745fe6ef851e93ceb6a7c9866b56a37d8
SHA512709575c1cf3bb1368a1d709fee787d0103cbc866822eb7b0943a0e3a335f68c8cb8158105fa7b13327fbecb5bc37f18c45f42011d1aac99ce25f357b73ae8a8c