Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0920b378e2487691c98ed4f0b874d4d0N.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
0920b378e2487691c98ed4f0b874d4d0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
0920b378e2487691c98ed4f0b874d4d0N.exe
-
Size
96KB
-
MD5
0920b378e2487691c98ed4f0b874d4d0
-
SHA1
2d2330fb1392c804a3cf42b68aa1372a50ba0eb1
-
SHA256
01e80f0018a49b7ddc030a18a19856bee59f3b071a7f77e4cb54a4f073e17742
-
SHA512
b16459ec4dc07a3a5440758a3596769592bbcd0dda361cbe3554e87f557c28d977496afa29a4d804458d1b650d5f5090d14d5cc1af6dd312fa76cebc1ea1ae7e
-
SSDEEP
384:F6eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:F6eHIMgPRlUUC151Npquv3Rnk+E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2740 xplorer.exe -
Loads dropped DLL 5 IoCs
pid Process 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 2784 0920b378e2487691c98ed4f0b874d4d0N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0920b378e2487691c98ed4f0b874d4d0N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 0920b378e2487691c98ed4f0b874d4d0N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 0920b378e2487691c98ed4f0b874d4d0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0920b378e2487691c98ed4f0b874d4d0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe Token: SeDebugPrivilege 2740 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 2740 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2844 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 31 PID 2784 wrote to memory of 2844 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 31 PID 2784 wrote to memory of 2844 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 31 PID 2784 wrote to memory of 2844 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 31 PID 2844 wrote to memory of 2812 2844 cmd.exe 33 PID 2844 wrote to memory of 2812 2844 cmd.exe 33 PID 2844 wrote to memory of 2812 2844 cmd.exe 33 PID 2844 wrote to memory of 2812 2844 cmd.exe 33 PID 2784 wrote to memory of 2740 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 34 PID 2784 wrote to memory of 2740 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 34 PID 2784 wrote to memory of 2740 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 34 PID 2784 wrote to memory of 2740 2784 0920b378e2487691c98ed4f0b874d4d0N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\0920b378e2487691c98ed4f0b874d4d0N.exe"C:\Users\Admin\AppData\Local\Temp\0920b378e2487691c98ed4f0b874d4d0N.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\AOKHY.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2812
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
96KB
MD58259cfc729162e0df497295a5ac1ba22
SHA17c177612f6d068aaa7364dd4154e98675eda1c97
SHA2566de5c8f67c02a9b7c894dd3562ffe5d45e3d3588ac0f925d90572b0b02d35f45
SHA512cd2e2b173104b5cd1dbfe53dfaf3cc37429c09ecafaf5d7e6e8fcf701bf3addcd33714b1ed25581fc4fe90f735e35ca8e01ea106adbddb06817b084e7c899d96