Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 03:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe
-
Size
96KB
-
MD5
c67590148f71fb3a1127f0814351e7ca
-
SHA1
5ab2161846b204c1861ba4ae4cca90ebcd69de15
-
SHA256
e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33
-
SHA512
462fe1828b283d09e6108d7f7121a423fcb01ad206db65c7d4849dfeb1d01bcfe84d104dd38ccade30189d8feef5b2f6a6a4dd29a8c22e83f2187be3ee117d1f
-
SSDEEP
384:56eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:56eHIMgPRlUUC151Npquv3Rnk+E
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe -
Executes dropped EXE 1 IoCs
pid Process 1820 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe File opened for modification C:\Windows\xplorer\xplorer.exe e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe Token: SeDebugPrivilege 1820 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 1820 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1072 wrote to memory of 3480 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 87 PID 1072 wrote to memory of 3480 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 87 PID 1072 wrote to memory of 3480 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 87 PID 3480 wrote to memory of 2312 3480 cmd.exe 90 PID 3480 wrote to memory of 2312 3480 cmd.exe 90 PID 3480 wrote to memory of 2312 3480 cmd.exe 90 PID 1072 wrote to memory of 1820 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 91 PID 1072 wrote to memory of 1820 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 91 PID 1072 wrote to memory of 1820 1072 e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe"C:\Users\Admin\AppData\Local\Temp\e1e7e28f3a23df3b0b66e9944ec7f1eaea90c659303ddfa04cc737aea0073d33.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BHAET.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2312
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
96KB
MD50609965e5548c6a2217f95fd186e257f
SHA1d4de73142a29c42a0cdce0d39de01b7ab3ca331b
SHA2565a0b1529f8299ae1054127d0e5ccb974a441df2409443e9e0a49ae71216ba371
SHA5124afb199b5d02af1d3e233cff4514790d3c75d8f099cb8988c34c40be384230ba8c20b43a96e3ce351ea3674c42c0ee0e7d858bc13656a34a11d44825963e208e