Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-es -
resource tags
arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows -
submitted
23-05-2024 00:20
Static task
static1
Behavioral task
behavioral1
Sample
Xeroseps.atn
Resource
win7-20240221-es
windows7-x64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
Xeroseps.atn
Resource
win10v2004-20240508-es
windows10-2004-x64
3 signatures
30 seconds
General
-
Target
Xeroseps.atn
-
Size
1KB
-
MD5
f72756fefce775257ea8c75f2417ee7f
-
SHA1
31480ef38f6b8cb435761c4bd54820cc216ac84e
-
SHA256
f46f358917e8be39eb90b4439729d9ae2aff8c7d6bb26a8264533c0a98694a31
-
SHA512
2cc742d2e404e03a4058ffce4e64f9cbf507c665761c397d48022bff1063a380b4771bb14d8ae64c824f3085ac92920eafb8869761fd0ae37ad32ea42d203bfe
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 2548 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2068 wrote to memory of 2548 2068 cmd.exe rundll32.exe PID 2068 wrote to memory of 2548 2068 cmd.exe rundll32.exe PID 2068 wrote to memory of 2548 2068 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Xeroseps.atn1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xeroseps.atn2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam