Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe
-
Size
11KB
-
MD5
3d0676b29844c07530d73c67838e54b4
-
SHA1
5cf54bed1614a2919a72c142aa3687f0be5176c6
-
SHA256
aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41
-
SHA512
0cdbdfa5dc3507a0c9f891c5c0adf34431c41bc1cf9bcc6c342acdb86e126a1cee67d13adc4f4e36d5086bce8b29d0abe7a29dd73ccd2087ec85e7f3bb6f5dcd
-
SSDEEP
192:Zg6eHLE5KxkDpnqKjIdtaCRYvRtCk1rE1Ty68A3CuYYpZ7ES:G6eHIAx0pqNgHvRtoyhASuYYpZ7ES
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe -
Executes dropped EXE 1 IoCs
pid Process 2712 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe File opened for modification C:\Windows\xplorer\xplorer.exe aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe Token: SeDebugPrivilege 2712 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 2712 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4800 wrote to memory of 896 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 87 PID 4800 wrote to memory of 896 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 87 PID 4800 wrote to memory of 896 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 87 PID 896 wrote to memory of 4740 896 cmd.exe 90 PID 896 wrote to memory of 4740 896 cmd.exe 90 PID 896 wrote to memory of 4740 896 cmd.exe 90 PID 4800 wrote to memory of 2712 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 91 PID 4800 wrote to memory of 2712 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 91 PID 4800 wrote to memory of 2712 4800 aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe"C:\Users\Admin\AppData\Local\Temp\aed7e301fc665cdf7de0935edf4b9e9bd3df01c52bd094e247d56c5fe58fbc41.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VMJNI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4740
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
11KB
MD53940c2fd3959a3a95f3923a5064a0dde
SHA18a7598ecebcae2767ea497b52c883af89318cc35
SHA25631665b7c5b83cb939665227fc85fa45a214f80ff325b0b648c95128e8f87f6ea
SHA512289930b61d71fa59fddbbe6da169083c5753a2a0da6f9aa932bdd0f5d6e23478465f9c227616de5ec1cd4e57d328432211bbab9b976829d645d96c4ab29c112a