Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe
-
Size
96KB
-
MD5
5a1d2c9bfbe4d923f2414dbaf301d810
-
SHA1
cbf2fe236fb81816589cc7f7331e18130bf3869d
-
SHA256
0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77
-
SHA512
aa8a2aa10c0855bbf8a21f47feb0835dcc424f1127b14bd0329fff52892b8d963f0e84d57ed4f01c7992192a000d5a5816f40ae9d0799ed34ac1e4338d12451d
-
SSDEEP
384:E6eHIAx0pqNgHvRl4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRnkYpZ7E:E6eHIMgPRlUUC151Npquv3Rnk+E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2804 xplorer.exe -
Loads dropped DLL 5 IoCs
pid Process 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe Token: SeDebugPrivilege 2804 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 2804 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2880 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 30 PID 2904 wrote to memory of 2880 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 30 PID 2904 wrote to memory of 2880 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 30 PID 2904 wrote to memory of 2880 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 30 PID 2880 wrote to memory of 2744 2880 cmd.exe 32 PID 2880 wrote to memory of 2744 2880 cmd.exe 32 PID 2880 wrote to memory of 2744 2880 cmd.exe 32 PID 2880 wrote to memory of 2744 2880 cmd.exe 32 PID 2904 wrote to memory of 2804 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 33 PID 2904 wrote to memory of 2804 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 33 PID 2904 wrote to memory of 2804 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 33 PID 2904 wrote to memory of 2804 2904 0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe"C:\Users\Admin\AppData\Local\Temp\0e9f84297e2b0158c7b8ffe7df981ef68e152ff6f0b798b86589a9aa97c8fc77N.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QURFR.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2744
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
96KB
MD57d196d36d454dbc6fb95410270fc5315
SHA19e099ce28fce5c48445a86fc1df3442445557949
SHA256c4f7cf2557eff85d45f13581ee9adc79da198ad33aa55e9bc726b5fd7ac16b2a
SHA5121a7501907a7bd61074e693efd70050c07a6629d2b5d5787336a024df4d23085823a8b976ce9839257752d84ad5a47117b9a351d3635f8bf4deaaeaaba6d6afe4