Resubmissions
06-08-2024 09:48
240806-ls68hswcqr 7Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f507d0fd5aca01dc96893901cf35a00N.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
8f507d0fd5aca01dc96893901cf35a00N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
8f507d0fd5aca01dc96893901cf35a00N.exe
-
Size
11KB
-
MD5
8f507d0fd5aca01dc96893901cf35a00
-
SHA1
4a97ffae3d9cc27bfe5c6a180dba3232ea2932de
-
SHA256
1167e1bc02116d970fc0507496cc176325278bdd4c61a673d1da3349870c0adc
-
SHA512
869f408926dc910a688f4cab5d9b624d409c5ce23cbab21dad60c7cfc4786320c7404efada427e24216ea3769cd09feff7dde9bc4ac95ecd4a1162ee0e89ef60
-
SSDEEP
192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7E:G6eHIAx0pqNgHvRtoyhASuYYpZ7E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2776 xplorer.exe -
Loads dropped DLL 5 IoCs
pid Process 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 2564 8f507d0fd5aca01dc96893901cf35a00N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8f507d0fd5aca01dc96893901cf35a00N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 8f507d0fd5aca01dc96893901cf35a00N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 8f507d0fd5aca01dc96893901cf35a00N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f507d0fd5aca01dc96893901cf35a00N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe Token: SeDebugPrivilege 2776 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 2776 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1696 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 31 PID 2564 wrote to memory of 1696 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 31 PID 2564 wrote to memory of 1696 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 31 PID 2564 wrote to memory of 1696 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 31 PID 1696 wrote to memory of 2332 1696 cmd.exe 33 PID 1696 wrote to memory of 2332 1696 cmd.exe 33 PID 1696 wrote to memory of 2332 1696 cmd.exe 33 PID 1696 wrote to memory of 2332 1696 cmd.exe 33 PID 2564 wrote to memory of 2776 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 34 PID 2564 wrote to memory of 2776 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 34 PID 2564 wrote to memory of 2776 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 34 PID 2564 wrote to memory of 2776 2564 8f507d0fd5aca01dc96893901cf35a00N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f507d0fd5aca01dc96893901cf35a00N.exe"C:\Users\Admin\AppData\Local\Temp\8f507d0fd5aca01dc96893901cf35a00N.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LULAU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2332
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
11KB
MD5d956228dee94369fc3726ce54d53b46c
SHA103b721e8e30b02700137d41acd89c55960edf772
SHA2568cc36c2545f6f86ef61239b05d66a469b3f994baaa217da1384e61cc04b572e1
SHA512224600073806ff6115d47e74a99b39134a12cb8b91c12ceab6b14c1002d74d4b53ada4c83a16d959cec414a62f733e7df92da232a488d0c41275a7068876fd14