535ef7612c7df7575e71de9d5b2cab73f05778ec78b05a327935c9284237aaa4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xylex.exe
Size 10.9MB
Sample240605-23bglabd7x
SHA256 535ef7612c7df7575e71de9d5b2cab73f05778ec78b05a327935c9284237aaa4
MD5 4c83d48259259be5247e415d57ea99f2
SHA1 b75640c27c585205f428def0b9acf4d4a148838f
SHA512 3dea78ad88f4e12e4242ee25a032b1a0f8d3d1262351cd30d76edc76487303cc91f9d29367e5b63f221e2edbd7ffc8bf1f569029c30a7bda66b41c746b67d52c
SSDEEP 196608:UhCuNPAVSwLRXgWPmpzdhqiUeNvX+wfm/pf+xfdkRhZWKsnOrIWOzW0DaqhH:06V5L1V8dvvX+9/pWFGRDBsnOrIWeRao
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2556	xylex.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000186d3-46.dat	upx

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2556	2260	xylex.exe	28
PID 2260 wrote to memory of 2556	2260	xylex.exe	28
PID 2260 wrote to memory of 2556	2260	xylex.exe	28
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1740 wrote to memory of 1228	1740	firefox.exe	30
PID 1228 wrote to memory of 1596	1228	firefox.exe	31
PID 1228 wrote to memory of 1596	1228	firefox.exe	31
PID 1228 wrote to memory of 1596	1228	firefox.exe	31
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 1440	1228	firefox.exe	32
PID 1228 wrote to memory of 2572	1228	firefox.exe	33
PID 1228 wrote to memory of 2572	1228	firefox.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xylex.exe
"C:\Users\Admin\AppData\Local\Temp\xylex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\xylex.exe
  "C:\Users\Admin\AppData\Local\Temp\xylex.exe"
  2⤵
  - Loads dropped DLL
  PID:2556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.0.281406105\492927344" -parentBuildID 20221007134813 -prefsHandle 1268 -prefMapHandle 1128 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1009dda8-a4bd-4be6-88c4-30488c97d241} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 1344 10af8d58 gpu
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.1.487903747\891126077" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e985f8-c7c1-4d23-b195-2a495c2db0a3} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 1532 f43ea58 socket
    3⤵
    - Checks processor information in registry
    PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.2.196527075\299570002" -childID 1 -isForBrowser -prefsHandle 1868 -prefMapHandle 2056 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30895e61-1476-479e-bca1-65feab58836a} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 2216 1a18db58 tab
    3⤵
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.3.1896451096\220208927" -childID 2 -isForBrowser -prefsHandle 2492 -prefMapHandle 2488 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61fd9195-5b06-4f69-b93d-b70531020afb} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 2504 e5b258 tab
    3⤵
    PID:1140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.4.1935697559\1448645683" -childID 3 -isForBrowser -prefsHandle 3008 -prefMapHandle 3004 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92920784-2c6f-449a-a90b-5d02d76b27b4} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 3020 1a772d58 tab
    3⤵
    PID:608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.5.35985580\425888997" -childID 4 -isForBrowser -prefsHandle 3512 -prefMapHandle 3792 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6d16e4c-271a-426d-b838-46828b3ff023} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 3816 1a703258 tab
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.6.2008627810\1442889797" -childID 5 -isForBrowser -prefsHandle 3924 -prefMapHandle 3928 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fb06e05-1b12-47a6-97ae-0b477ff4facd} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 3912 1a704458 tab
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.7.1765536409\413252314" -childID 6 -isForBrowser -prefsHandle 4108 -prefMapHandle 4112 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae616cd0-f4f0-4025-9841-794ec9e2070c} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 4100 1a705c58 tab
    3⤵
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22602\python311.dll
Size 1.6MB
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
SSDEEP 49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 b64c0f7c08f05d9a18d9d66d8c174783d7b98618c22838b811c31256d094c011
MD5 41622387d25c4458e7e44d9fec221a62
SHA1 cda01a865015592d61b2b79df2202eb1d275d04b
SHA512 37b5ba2eb6fb6038761ec1dad64330b92e0c20be2eeee5e06eeff414ff990ff65543310cdb418329e4a149aad4f2e099fb1b7c938f1c1d2d3542d30d7f701849
MD5 SHA1 SHA512

Submit Download

217e94b1-f2c8-45bf-93fe-4c16d0532341

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\217e94b1-f2c8-45bf-93fe-4c16d0532341
Size 11KB
SHA256 889738a3e83caa3d6018160b808972efd3ddb487b719c236c9e84191f20b02c4
MD5 bd735e0a93b8223ffa2e747e9f5afb19
SHA1 f519e67726fbed33dc0fa5770e3b32058b63627a
SHA512 a8dba2a1203880d190ac20a759d551e3f5539bdad2486372a10c261346da7b893c31c253f30200422b1fd5a0bd4261c07af046e8d59d5f94b51349dfb06c7e59
SSDEEP 192:nYUPRuxVg0EYgTJLAwVR0tQj5B/LnIvoQjlMbpEDhtC12DxNqgqHKoyWEM:nV9+STHhEM
MD5 SHA1 SHA512 SSDEEP

Submit Download

42f354a5-e1da-4d37-a059-88294164499c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\42f354a5-e1da-4d37-a059-88294164499c
Size 745B
SHA256 22abcdb43bd39a14b6251d31d5e0e5c93671a00740ef9c6caf060f6938fbf1b8
MD5 5abbae73a0ef9873a7b1e857a0b29118
SHA1 42f39f1304500533425e226d3603664f560f8885
SHA512 c3c274231b99961a132b16b8239c7469f5a3b689433e859892f05a23dc87df30d3a0279b812e391899c23d0af9f665fecc82289e6ce2c263bf6fdcffbeae7b37
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.js
Size 6KB
SHA256 694d5211781f47369111338962e5559f379949f4999d857e0e6ac5d38592474a
MD5 eaf802ccbdf935751b5c7bc5a894ce99
SHA1 7ea0a4cba792cc972518cae8b89e161665a2a007
SHA512 7b2a0ac62bfb77ecaf058e7945966d60ad3f681dcdeb7bccaab106e4b40d74bce55052362b59ce92fb9c0f745f6eaf9a219a0246c1a38ad4fd2c3b869e68b048
SSDEEP 96:xHo5nUTeqGqXvLdCyxeOTzSFQ5PXAnpjIHF4GxVN0sBw8HWB:+5nIRXvLdCyxeo5PXptZ0sBw8Ha
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore-backups\recovery.jsonlz4
Size 966B
SHA256 08beaef987125d3aa5217d0ac8ed40b16d9f7ff15aaf909721a9fccc371d40a3
MD5 0be6147410deb4392df793f2d4978afe
SHA1 d12fbd735d34d703e2f7cf83c5700ecf4e58c89d
SHA512 ae4630c6e7ce534c92ff1fa4e04b13b8229cc90b17c28bc2b2b89055907d70cc036202c1a5efbbe14fe366bb8d9e10c5edb44f1d542120b6e0be250cfd10ba25
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore.jsonlz4
Size 843B
SHA256 bde44b7954d741759dff824f189ae07d70259a32824f3e1e60c8e73d0fe39e40
MD5 93919b8db5b6c6160cf8a2599019cd1a
SHA1 c3f380437e8a322780a5906afb22ef62bc12e7b4
SHA512 acde83de92cc9472e29a2abcd15cc3e81a97f4b85521cf45c402ddbaa32e9506070244081cf69646be4876ad6810ba818c56c7999287a5bab513e2b9920ef1c4
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 b9028ac5b4d8e6226dae0eb9592fe45c58c930342ce4c5dadd743c188ef9b465
MD5 24ef81d1d44aa87a83cf61c79193617a
SHA1 e6b8418868619ac3ff97c62a96e47e15aa069af9
SHA512 9e0de5268f5fcd0b8faad23dc0525c908c77f1f47c625d5a7029129805b4e34b5e28fecb2925b0eefd09ae7f809f3d97ff7926645a0e359945360e1a71529a0c
SSDEEP 3072:lGcHzPRuFPF3y3O6g39636uacM1eHr2xbDUB7:lGcHzPR093y3O636uacM1eHrtB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2556-48-0x000007FEF5F30000-0x000007FEF6518000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads