Resubmissions

12-10-2024 10:59

241012-m3mgja1frq 6

12-10-2024 10:54

241012-mzm9na1fjj 8

12-10-2024 10:51

241012-mx9pwawhjg 7

Analysis

  • max time kernel
    121s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2024 10:51

General

  • Target

    net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66F88D85-3254.pma

  • Size

    1.2MB

  • MD5

    8bf75f235e5a0b35c967d2d8562660ae

  • SHA1

    559e82a64ca53a8a4dcdca350089484096f80580

  • SHA256

    06b08fb44903a1a752792064f7b4a67d9c02e206696f0fa19d9904815ef8b0b6

  • SHA512

    108dbf37815e8f969733dd1fef38ee46c7c487b43e061ea02abe438801ff86a108d71d8cea4ba78ebe453e9efcaa1bf6556f70b3f7042a1727d0fe211d8e1014

  • SSDEEP

    1536:iZ7zCQAIMy1pME5TRGg1DRFFZbqaRGwV0U5BzAs4g0y9/qfA849tUIod:iZ7WQFMUME5Mg1HFZbqz+vzAs4ghO

Score
6/10

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ed89e6f424e3dbf1ac8a4cbecc720ef0

    SHA1

    69fbe618752b8c11f5f30bf23f68d3280756d2a9

    SHA256

    70649a62de64c9e844e50a2ed4e022b360f72e8c940be75b3d272dff3edee251

    SHA512

    12ccc501da58d21f6589ed6c91cb7292a89b57c4033ca362e85794ef8627c4c4b4149dc281f2a8dce35f4166a3dd736bd540db0787ab0bee1f631fdd1ffc2314