Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
542f22cd99cf533c3cfb04da535181e0N.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
542f22cd99cf533c3cfb04da535181e0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
542f22cd99cf533c3cfb04da535181e0N.exe
-
Size
56KB
-
MD5
542f22cd99cf533c3cfb04da535181e0
-
SHA1
f66138b287d866a7619b5f8bfa0b9e3065fdaa2f
-
SHA256
22853135fc39344c3abb84a2b145c9ec1f4f2ce044f98cfafab19aaf16442f9f
-
SHA512
a5f4d1caba8a74a9af173c229d74a57b880f651bc141f8b4261854d60e8cc11194d14a988ea49f06b51dcb573b19ff70bf8f6806c1aeec9f86269a1e3b288c9a
-
SSDEEP
768:FNHVPFi90pubI3f0mq/6/Q/9NF0+LEc8af3ts0E9N:Fhihkdq2oS+Ljb3ts0E9N
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeaxa.exe -
Executes dropped EXE 1 IoCs
pid Process 2724 xeaxa.exe -
Loads dropped DLL 2 IoCs
pid Process 2672 542f22cd99cf533c3cfb04da535181e0N.exe 2672 542f22cd99cf533c3cfb04da535181e0N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeaxa = "C:\\Users\\Admin\\xeaxa.exe" xeaxa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeaxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 542f22cd99cf533c3cfb04da535181e0N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe 2724 xeaxa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2672 542f22cd99cf533c3cfb04da535181e0N.exe 2724 xeaxa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2724 2672 542f22cd99cf533c3cfb04da535181e0N.exe 30 PID 2672 wrote to memory of 2724 2672 542f22cd99cf533c3cfb04da535181e0N.exe 30 PID 2672 wrote to memory of 2724 2672 542f22cd99cf533c3cfb04da535181e0N.exe 30 PID 2672 wrote to memory of 2724 2672 542f22cd99cf533c3cfb04da535181e0N.exe 30 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29 PID 2724 wrote to memory of 2672 2724 xeaxa.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\542f22cd99cf533c3cfb04da535181e0N.exe"C:\Users\Admin\AppData\Local\Temp\542f22cd99cf533c3cfb04da535181e0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\xeaxa.exe"C:\Users\Admin\xeaxa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD59b2b5d82de0807c9d2eab470914fb412
SHA151275a3f80af6f67b84d75504e65e5323aa50fe3
SHA2561641ee3953f48603fc022eca5c497806e9cfceebaa196f25e8cb309128b6a27c
SHA512a64ece67ef96da1e22e0949a4f143d15f27dd88d147d4cbf02e835e4e9cad5b7b4911f87af0695a108c59b1af63fd59e8aead55c5972fe13a0364037b854f2fd