Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/09/2024, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbee1b89403eed836ad3cc8621561fe0N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
cbee1b89403eed836ad3cc8621561fe0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target cbee1b89403eed836ad3cc8621561fe0N.exe
- Size 96KB
- Sample240904-17ppcaydpa
- SHA256 31e3d1a82ef42d5e11ea01d1defff4b951240dbf66c9788c8b9274cb770d703b
- MD5 cbee1b89403eed836ad3cc8621561fe0
- SHA1 40936dcc21737258a7855070441acb58d0ce86d3
- SHA512 564be2bdbf46fb7bb2eec939907547a7e4f1975319ffc1c2053f6e79ffdf37b4583f8218b5fe83674ebd73e7e149929d39bde8267ffa54980cc7ba70852cf121
- SSDEEP 384:36eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:36eHIMgPRlUUC151Npquv3Rnk+E
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation cbee1b89403eed836ad3cc8621561fe0N.exe - Executes dropped EXE 1 IoCs
pid Process 4748 xplorer.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe cbee1b89403eed836ad3cc8621561fe0N.exe File opened for modification C:\Windows\xplorer\xplorer.exe cbee1b89403eed836ad3cc8621561fe0N.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cbee1b89403eed836ad3cc8621561fe0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe Token: SeDebugPrivilege 4748 xplorer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 4748 xplorer.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4188 wrote to memory of 4448 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 86 PID 4188 wrote to memory of 4448 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 86 PID 4188 wrote to memory of 4448 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 86 PID 4448 wrote to memory of 3132 4448 cmd.exe 89 PID 4448 wrote to memory of 3132 4448 cmd.exe 89 PID 4448 wrote to memory of 3132 4448 cmd.exe 89 PID 4188 wrote to memory of 4748 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 90 PID 4188 wrote to memory of 4748 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 90 PID 4188 wrote to memory of 4748 4188 cbee1b89403eed836ad3cc8621561fe0N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbee1b89403eed836ad3cc8621561fe0N.exe"C:\Users\Admin\AppData\Local\Temp\cbee1b89403eed836ad3cc8621561fe0N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WMIHU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3132
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\WMIHU.txt
- Size 124B
- SHA256 168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
- MD5 4e6e99d38b1264af2b53a68c7cd6d648
- SHA1 55ffe17732d1d9c539d702a1311ef9674fe7b3cf
- SHA512 bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
- MD5 SHA1 SHA512
- Path C:\Windows\xplorer\xplorer.exe
- Size 96KB
- SHA256 540e57204e7608caac9665a782a73be6cd6886205abef626ba22f42ed911baba
- MD5 41afcd38c200cdec64c0cf5b25b6f3a6
- SHA1 db261642ee83b9379c38d478fae4aaa6ced94608
- SHA512 6865df596aa1cc5b021fbce01f4677d17b62c3bfc91a2be899dd42604dba4bf06f48a09a8565f99431e18916c120b99e40e82c8e10936c652bd2805a70288afb
- SSDEEP 384:36eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:36eHIMgPRlUUC151Npquv3Rnk+E
- MD5 SHA1 SHA512 SSDEEP