7f1379494206446bcd9e4c082bf2f15b84e06f903745c753d3f574432b74fb3e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XSearch.exe
Size

1.3MB
MD5

c23fde05171239288e05c3207525438d
SHA1

15300ad99d8c9777bbb14eaa8914faac8c0b4a8d
SHA256

b845ce9645519ca7e4d624474875906162d9ce70308308429e03682319baf6a7
SHA512

ad54153413d6598b662f6c885af73fa72af6f6563835e9dd2d2b7aaa7273e264f8f43e5905ed2f7d8114dbee41f089675d18744d2188f4fbbdd3f47212272d1e
SSDEEP

24576:7gOQ+q/bCuHJS0C3OnCcL0z/ifgcEGCg8HsIq5:7gr+q/b3y7V/MgLGCgFIs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	XSearch.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	XSearch.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XSearch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	XSearch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	XSearch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	XSearch.exe

C:\Users\Admin\AppData\Local\Temp\XSearch.exe
"C:\Users\Admin\AppData\Local\Temp\XSearch.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000003920000-0x0000000003930000-memory.dmp

Filesize
64KB

Download