Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 13:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ae0608c4c92bdd30f927cf2d2f20690N.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
1ae0608c4c92bdd30f927cf2d2f20690N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
1ae0608c4c92bdd30f927cf2d2f20690N.exe
-
Size
11KB
-
MD5
1ae0608c4c92bdd30f927cf2d2f20690
-
SHA1
abf6c37867990af001c9a6d3f9ef289ca9587326
-
SHA256
82c94876f4751dfd47f670099da3957333dd437eca805ab25059937a44b21f75
-
SHA512
7784b0b156ecaa5659ad86f3eb9547f78d67265a9b2815e93edcecf464bc2c5f7ec728b156b3c943781579e829d138e38b81635b8cfcbdb203314c16bf93d148
-
SSDEEP
192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7E:G6eHIAx0pqNgHvRtoyhASuYYpZ7E
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 1ae0608c4c92bdd30f927cf2d2f20690N.exe -
Executes dropped EXE 1 IoCs
pid Process 2052 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 1ae0608c4c92bdd30f927cf2d2f20690N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 1ae0608c4c92bdd30f927cf2d2f20690N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ae0608c4c92bdd30f927cf2d2f20690N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe Token: SeDebugPrivilege 2052 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 2052 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1524 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 88 PID 1220 wrote to memory of 1524 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 88 PID 1220 wrote to memory of 1524 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 88 PID 1524 wrote to memory of 3152 1524 cmd.exe 91 PID 1524 wrote to memory of 3152 1524 cmd.exe 91 PID 1524 wrote to memory of 3152 1524 cmd.exe 91 PID 1220 wrote to memory of 2052 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 92 PID 1220 wrote to memory of 2052 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 92 PID 1220 wrote to memory of 2052 1220 1ae0608c4c92bdd30f927cf2d2f20690N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae0608c4c92bdd30f927cf2d2f20690N.exe"C:\Users\Admin\AppData\Local\Temp\1ae0608c4c92bdd30f927cf2d2f20690N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BBQRO.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3152
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
11KB
MD57843eceef2d77a7b905a181edfd5e439
SHA17c504927d1e1f4e013ec5e0ad44e11e7a548707c
SHA256d1f3d82459b2faca80338f711be152b57f7921559162eb9db7e8617f8c23a60e
SHA512a801b00242fabb888a85e487156dc68e741fc10a914b110523bdf778dad5affbd1543c9d7ed4e655ea4a0b2a93bdc2c8031fc1cb81df8d0b9997426fd5d65611