Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2024, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe
- Size 11KB
- Sample241102-dkr5mayepk
- SHA256 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e
- MD5 ebe858ca605b6be9a1a70237d16a3ae9
- SHA1 16b9c14e594047d72a1ce8e11efaf69d90a67bd6
- SHA512 2f2d29974928b33ca91017be258244a0566441d5874b57854c2aadef5747f201700e38b3094b63b8f449bdbd6756f211ab555f34304efdcaba000946ca210a82
- SSDEEP 192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7EB1:G6eHIAx0pqNgHvRtoyhASuYYpZ7E
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe - Executes dropped EXE 1 IoCs
pid Process 540 xplorer.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe File opened for modification C:\Windows\xplorer\xplorer.exe d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe Token: SeDebugPrivilege 540 xplorer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 540 xplorer.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3252 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 88 PID 3424 wrote to memory of 3252 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 88 PID 3424 wrote to memory of 3252 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 88 PID 3252 wrote to memory of 3572 3252 cmd.exe 91 PID 3252 wrote to memory of 3572 3252 cmd.exe 91 PID 3252 wrote to memory of 3572 3252 cmd.exe 91 PID 3424 wrote to memory of 540 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 92 PID 3424 wrote to memory of 540 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 92 PID 3424 wrote to memory of 540 3424 d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe"C:\Users\Admin\AppData\Local\Temp\d134218dc2f23b8776fa066ad73845ffe4864ccbc034124b7887f0f68e5a763e.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FUVTB.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3572
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\FUVTB.txt
- Size 124B
- SHA256 168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
- MD5 4e6e99d38b1264af2b53a68c7cd6d648
- SHA1 55ffe17732d1d9c539d702a1311ef9674fe7b3cf
- SHA512 bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
- MD5 SHA1 SHA512
- Path C:\Windows\xplorer\xplorer.exe
- Size 11KB
- SHA256 40f66cf4f4b1f2ec70bb73119886f80a66d0b213907710db30bf192c0acff16e
- MD5 5d977abdbb3a28060f2a5318da913c0d
- SHA1 16415a60dcf6271fc8a80d6f1ee1afe515ec0207
- SHA512 833709c33e9899fcf958c9edb83a9c5736525ef12640b05774b431cba3ffb4c0354f2dc9401955c021703334379fef446601787a3a9daafd85c1257cc72b1669
- SSDEEP 192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7EH:G6eHIAx0pqNgHvRtoyhASuYYpZ7E
- MD5 SHA1 SHA512 SSDEEP