Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:18
Behavioral task
behavioral1
Sample
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
-
Size
20KB
-
MD5
2dd4a8a4c467a278b74ce6d0e170e390
-
SHA1
de28c86ab95df2751020e3432af2b2edd144ab55
-
SHA256
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5
-
SHA512
e9ceb15ddab53b1bd4ac7413bdc453e0c31e78de5d48728aee3509ece44fc6a01cb15a36eaf119ee87982442fb624c38ac13c3fe3e1769f5979a60fed9cc9be3
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU2b:9KE7pXaNJawcudoD7U7S5Ev2b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2508 xplorer.exe -
Loads dropped DLL 5 IoCs
pid Process 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe -
resource yara_rule behavioral1/memory/1960-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000016dc8-25.dat upx behavioral1/memory/1960-46-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2508-52-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe Token: SeDebugPrivilege 2508 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 2508 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2480 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 30 PID 1960 wrote to memory of 2480 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 30 PID 1960 wrote to memory of 2480 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 30 PID 1960 wrote to memory of 2480 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 30 PID 2480 wrote to memory of 844 2480 cmd.exe 32 PID 2480 wrote to memory of 844 2480 cmd.exe 32 PID 2480 wrote to memory of 844 2480 cmd.exe 32 PID 2480 wrote to memory of 844 2480 cmd.exe 32 PID 1960 wrote to memory of 2508 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 33 PID 1960 wrote to memory of 2508 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 33 PID 1960 wrote to memory of 2508 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 33 PID 1960 wrote to memory of 2508 1960 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe"C:\Users\Admin\AppData\Local\Temp\4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HVVJK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:844
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD57e9d8281b8c176c0e36e7ecfba2e168c
SHA11ee450645b91e8da45eebfc32e1ba79f98b91752
SHA256787aaeaaad5eb75144ff908bfdfece1b15888bcce30b2d457d4f4ddbbdebd41a
SHA51292679ce16c923bdb698a75ce96fb32520a0384a0e62fc418b6f2fe249c7110a0f3d7fce0f7c26de875e618785a8d286fb87438f54c0767cada1fc2045d8403bf