Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 23:05
Behavioral task
behavioral1
Sample
0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe
-
Size
20KB
-
MD5
cd273cbe1f1d6ee86861b4193460dca0
-
SHA1
f517e387635d76c6afdc7e3b13629d8b78281ab8
-
SHA256
0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071
-
SHA512
ebb331cdf36ac360d53b641ba5411c3a64d03aa8ad0408f27f03cc7901faac5a63123493b11d01a7916b2928699c46639ad2f9131aaed534598d326351db238e
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU:9KE7pXaNJawcudoD7U7S5Ev
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2736 xplorer.exe -
Loads dropped DLL 5 IoCs
pid Process 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe -
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0030000000016fb3-25.dat upx behavioral1/memory/2520-39-0x00000000005A0000-0x00000000005AB000-memory.dmp upx behavioral1/memory/2520-44-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe Token: SeDebugPrivilege 2736 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 2736 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2920 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 30 PID 2520 wrote to memory of 2920 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 30 PID 2520 wrote to memory of 2920 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 30 PID 2520 wrote to memory of 2920 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 30 PID 2920 wrote to memory of 2116 2920 cmd.exe 32 PID 2920 wrote to memory of 2116 2920 cmd.exe 32 PID 2920 wrote to memory of 2116 2920 cmd.exe 32 PID 2920 wrote to memory of 2116 2920 cmd.exe 32 PID 2520 wrote to memory of 2736 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 33 PID 2520 wrote to memory of 2736 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 33 PID 2520 wrote to memory of 2736 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 33 PID 2520 wrote to memory of 2736 2520 0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe"C:\Users\Admin\AppData\Local\Temp\0475d9167fe8b67e04b21f4a20f8edf0360707ebb58f58df5961d2cc0f761071N.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XWIRI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2116
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD5bfd29e785d863a06458b264671e10071
SHA16014dfd4178ac572e9bd15abdb56b0c07de17f7c
SHA25652e63b6a1ac258572d4b913400598ec78d63ca067f6b578d5da19b5ab80b6cca
SHA5125f85f5de2f4ed00470a1ac7be076379486b91cc2725bbcdd8e5142c32ac9c6ca17877be16dd52ef765b138f843602706e35fc6d54b98a91496a18df3c81e4c76