1d14500a00d5f63a796ae8002eaacb21ee3feb348ab52f3d74c85c0f914347c5 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:24

Sharing

Report Analysis Logs

General

Target

bin/xScan.exe
Size

108KB
MD5

d19629bb7227515252630d657c55c29c
SHA1

4142946516e0121b03df8d98c57482382c891ccf
SHA256

2b4c4dab44943138ec371cd15741b1d61a474ef2bd27461c7faa9a154afd9f71
SHA512

515c05a7a87cd578bfa58a059f3b47d7e693fc41e87a24f4e55b798b3e25030c88647d846f35830d6cbd3855c88fdcce8d8756644a320d47a14fb682cd586808
SSDEEP

3072:m1TEjRTq7frBQ4+mffCICfurCmk7+mrf3YG3Jnmt7Liyu7:YEjNq7frBQLgflCfOC4mrvYGZnk

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\printto	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\xScan.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\print\command	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\print	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\printto\command	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.FAX\ShellNew	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.FAX\ShellNew\NullFile	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\open\command	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\xScan.exe,1"	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\open	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\xScan.exe \"%1\""	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.FAX\ = "XScan.Document"	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\ = "XScan Document"	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\DefaultIcon	xScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XScan.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\xScan.exe /p \"%1\""	xScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.FAX	xScan.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2336	xScan.exe
2336	xScan.exe

C:\Users\Admin\AppData\Local\Temp\bin\xScan.exe
"C:\Users\Admin\AppData\Local\Temp\bin\xScan.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-10-0x0000000075690000-0x000000007569F000-memory.dmp

Filesize
60KB

Download