xorist | 37892b106151d95d58ba7709e4e742720b72d33dc65763be51b49f18b9c9da50

Analysis

max time kernel
24s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 15:12

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe
Size

540KB
MD5

093fc6529d2e14e9a39bf7eccd93996e
SHA1

7de0a9ff175cd2074cd53ac6554715deab9d8455
SHA256

37892b106151d95d58ba7709e4e742720b72d33dc65763be51b49f18b9c9da50
SHA512

03cbba9db5e730ff293a718bea5673885aa60bf6b46ba72bd28063490cd2411eb5703b3720ff3efc124b0e56bd9dc617428572856a05ec9a41cbb494601b008a
SSDEEP

3072:mhaV4SMBTNEMvTHVmulZoZVz93FT36MkIhMz+nmMS:mE4SMB6MvTHVmuPoZ3FT36wVnmM

Score

10^/10

xorist bootkit discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/4208-141-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
4640	saverbl.exe
4208	blockk.exe
3772	sys3.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000235f7-27.dat	upx
behavioral2/memory/4208-32-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4208-141-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f05G223qnsuh438.exe"	blockk.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	saverbl.exe
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	blockk.exe
File created	C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	blockk.exe
File created	C:\Program Files\7-Zip\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	blockk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	blockk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\shell\open\command	blockk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f05G223qnsuh438.exe"	blockk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PoPaDaLoVo\ = "HGGLRPWRBURGDWF"	blockk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f05G223qnsuh438.exe,0"	blockk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\ = "CRYPTED!"	blockk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\DefaultIcon	blockk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\shell	blockk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF\shell\open	blockk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PoPaDaLoVo	blockk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HGGLRPWRBURGDWF	blockk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe
2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3772	sys3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4640	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	96
PID 2584 wrote to memory of 4640	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	96
PID 2584 wrote to memory of 4640	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	96
PID 2584 wrote to memory of 4208	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	97
PID 2584 wrote to memory of 4208	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	97
PID 2584 wrote to memory of 4208	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	97
PID 4640 wrote to memory of 3772	4640	saverbl.exe	98
PID 4640 wrote to memory of 3772	4640	saverbl.exe	98
PID 4640 wrote to memory of 3772	4640	saverbl.exe	98
PID 2584 wrote to memory of 4540	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	99
PID 2584 wrote to memory of 4540	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	99
PID 2584 wrote to memory of 4540	2584	093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\saverbl.exe
  "C:\Users\Admin\AppData\Local\Temp\saverbl.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\sys3.exe
    C:\Users\Admin\AppData\Local\Temp\\sys3.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- C:\Users\Admin\AppData\Local\Temp\blockk.exe
  "C:\Users\Admin\AppData\Local\Temp\blockk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\093fc6529d2e14e9a39bf7eccd93996e_JaffaCakes118.exe" >> NUL
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:5060

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bb055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
1023B

MD5
0a21b17f4a555ac725899f5ca5c25ad3

SHA1
25be1b261943f9685fa4511bdfc373c7f17bf0b6

SHA256
8a99230a60ffd59b95e0b7f0ebf20aba0a43ccf5ada675c4d9adb138d57bede1

SHA512
9cc18c44bb7b8cf12cca8f80e2cb7499cef5433fba7cd4ad5e48d68d3ade8d3e0ea30a839b1f78d48557380e1d82497c6786cdd5e7d244f741d4b3669dd70e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\blockk.exe

Filesize
8KB

MD5
5eee66a8bd72026d2131ef0b8ab3a617

SHA1
e1b049c2cea82f2c422c55b31a25f7be34cfaa0b

SHA256
cbd9fb7ee373ceffe599ebc726b6bdd2bd9cc66270b6b526ee6cf04b563dd3ef

SHA512
2282bc8367359fa04004a546a52b8771d3b4d9e266d93704c8d6b109b08654ea521b281a5e37abd39fa7360f53fc3ba007467ba19baa9bad26e5413b621028b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\saverbl.exe

Filesize
10KB

MD5
f14e212d976dc625bd21f49b84419846

SHA1
11e9f9c1ef4601bb6243aafb365a921e36e4d9a9

SHA256
1e3e93cc8fdb08a9712829d9b1bc2bc88acddc9e05daeb7c69c65421fb653bfe

SHA512
4172f1b9ea87806b67403313a9540fddeaeb3e60037e75fb4367700ba64e6c21a6bd629db6d009a73e1b4131679e9939990ed94318332f05cf3b6df7a424baf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\systm.txt

Filesize
45B

MD5
a65ae7589c003776677e39afab99bfb0

SHA1
96df2e7f36a623efbf9ea2a522a72f41632bb262

SHA256
3423754ba097beeedcb209e436c543046ddd7c7b28b3a64bfcd7e1dd3896a52f

SHA512
7372eafc20acdd9744d22f15626c853a780864a7ddb9133cee7f8a73c14b4b8cb0e05c08b18fb88d5393078323d6d04f2d340c0e1adc9213464d5abc12bfc1d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ufr_reports\NO_PWDS_report_24-06-2024_15-12-09-667E73AE-AJCF.bin

Filesize
1KB

MD5
72bd99710aef23aa24df3ecb28736778

SHA1
409cddba48dcea251a7111a98cd7ff8d2737a567

SHA256
3537e8b42c4dbaa0229ced84be8e771db3b5c4e6b4d434879e01d0d382f8856d

SHA512
3ae5905940898e4d65881f6a9d673d42b93be4ebc877c7fcf2ad7215b80e10a9c1bb849fd744eb5f5eb933a2b432f2b1c902b528ebc61f2718b76b9fc0f608d8

Download Submit
memory/2584-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2584-24-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2584-39-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4208-32-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4208-141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4640-25-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/4640-35-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads