51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Size

32KB
MD5

a89d64817add05eb629655149c6b51e5
SHA1

e7c2e4dc66ec91354277ba33a87d4033ccfecf40
SHA256

51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e
SHA512

1cd8977a0d5fd286c533982ac57226fe8e20e41040e8e23e1f2fd5e5b4501baf2435314dd8cc929906d267f57f84a56110d0e43759fa505e2ed873448f7384ec
SSDEEP

192:p/Hn5smrSUcVRwLgyAOSfUML5dyfeqR6J+idTcXNwfKYfwDLXkk65oa2hTbP4oy6:JnaUczqSMxRhIT7EHXfSoa2d43eZZIl4

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie\	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41906A82-C6BE-4329-96D5-543B29A18BA9}\ = "IThunderMx"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "C:\\Program Files\\xunjie\\XunJie.exe,26"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\URL Protocol	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\ = "XunJie Document"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\DefaultIcon\ = "C:\\Program Files\\xunjie\\XunJie.exe,0"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\Command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41906A82-C6BE-4329-96D5-543B29A18BA9}	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\Command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\ = "Open"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\DefaultIcon	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1864	2532	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	30
PID 2532 wrote to memory of 1864	2532	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	30
PID 2532 wrote to memory of 1864	2532	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	30
PID 2532 wrote to memory of 1864	2532	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	30

C:\Users\Admin\AppData\Local\Temp\51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
"C:\Users\Admin\AppData\Local\Temp\51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ydlem.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ydlem.bat

Filesize
516B

MD5
c308576595c4261d7f9de0c8dcff81fb

SHA1
cce2ac73273d9be337088c88c6d0b3d325b4d6ea

SHA256
19d07dc474a667286b9e2a13dbe9051d2151942471056b4c69a7513d13bca698

SHA512
168480b86dc6d6c4bafe571b2ce5e1aaffc78c9f759ea637b449a615175fd3bdcc46998c01f3951f61132900ac0dfdfc381735b7f53ed0a3da1fd23a10b7110b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ydlem.tmp

Filesize
32KB

MD5
df36a1f679354aeb0fe1bda8b3bd4b84

SHA1
f7fd0584d7ea744a77e79bc7e7b2a27c7e9fdc73

SHA256
86085751c19f9db44896860de411c7907576c71578a6ea26db871d70e5ac8a0f

SHA512
08a1729a1d359fc3d7874fab7ebf0ca87d12924212ee9c0b8184fc8b95ef6a1551546379568c2c3c4d8c1275431bb6416fcbc4a016d483be11dbddb3b52131d4

Download Submit