Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
386c7ea195401747c6f7bea1314adb00N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
386c7ea195401747c6f7bea1314adb00N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
386c7ea195401747c6f7bea1314adb00N.exe
-
Size
11KB
-
MD5
386c7ea195401747c6f7bea1314adb00
-
SHA1
3df211d363010776cc536eb02835dc6c357626d9
-
SHA256
45c1d2508ba85f787caed48cbc834547a5271d923bad51a1b39d2536353f42bf
-
SHA512
48f0297d3afd299c2a910d42a23c63fa2127d9d21d675d2392d79da8a6bf4922008d97aa26432fac75d6a1e5da2e32b16cbcaa257e8a1a9700f7c913bd90e42b
-
SSDEEP
192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7E:G6eHIAx0pqNgHvRtoyhASuYYpZ7E
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 386c7ea195401747c6f7bea1314adb00N.exe -
Executes dropped EXE 1 IoCs
pid Process 1700 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 386c7ea195401747c6f7bea1314adb00N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 386c7ea195401747c6f7bea1314adb00N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe Token: SeDebugPrivilege 1700 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 386c7ea195401747c6f7bea1314adb00N.exe 1700 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2904 wrote to memory of 744 2904 386c7ea195401747c6f7bea1314adb00N.exe 87 PID 2904 wrote to memory of 744 2904 386c7ea195401747c6f7bea1314adb00N.exe 87 PID 2904 wrote to memory of 744 2904 386c7ea195401747c6f7bea1314adb00N.exe 87 PID 744 wrote to memory of 4204 744 cmd.exe 90 PID 744 wrote to memory of 4204 744 cmd.exe 90 PID 744 wrote to memory of 4204 744 cmd.exe 90 PID 2904 wrote to memory of 1700 2904 386c7ea195401747c6f7bea1314adb00N.exe 91 PID 2904 wrote to memory of 1700 2904 386c7ea195401747c6f7bea1314adb00N.exe 91 PID 2904 wrote to memory of 1700 2904 386c7ea195401747c6f7bea1314adb00N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\386c7ea195401747c6f7bea1314adb00N.exe"C:\Users\Admin\AppData\Local\Temp\386c7ea195401747c6f7bea1314adb00N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WESRD.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
PID:4204
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
11KB
MD55a611c9542df72a64843aa38332e2fc2
SHA1bdc7322efe8083f710096a19a96c9b5a6fc15b9b
SHA256e791b1514ead6dd373bc1d81c1455f495c582ec6e3fceadbb0aa305badb3cdbd
SHA5123f2cb15996e497a0d66bbf2ae49b64139a6ec87f888970108e601b955b2ad572ad25640f6c5dd552002eb6e1ee0cfe0eb2fa14cdb4bbd192f91c24ecaa070f4c