51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Size

32KB
MD5

a89d64817add05eb629655149c6b51e5
SHA1

e7c2e4dc66ec91354277ba33a87d4033ccfecf40
SHA256

51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e
SHA512

1cd8977a0d5fd286c533982ac57226fe8e20e41040e8e23e1f2fd5e5b4501baf2435314dd8cc929906d267f57f84a56110d0e43759fa505e2ed873448f7384ec
SSDEEP

192:p/Hn5smrSUcVRwLgyAOSfUML5dyfeqR6J+idTcXNwfKYfwDLXkk65oa2hTbP4oy6:JnaUczqSMxRhIT7EHXfSoa2d43eZZIl4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41906A82-C6BE-4329-96D5-543B29A18BA9}\ = "IThunderMx"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\ = "XunJie Document"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\URL Protocol	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\DefaultIcon\ = "C:\\Program Files\\xunjie\\XunJie.exe,0"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "C:\\Program Files\\xunjie\\XunJie.exe,26"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\XunJie	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\XunJie\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\XunJie\	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41906A82-C6BE-4329-96D5-543B29A18BA9}	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\ = "Open"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\Command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\Shell\Open\Command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\xunjie\\XunJie.exe\" \"%1\""	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "XunJie.Association.HTML"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\ = "XunJie"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\XunJie\ = "Ñ¸½ÝÓÎÀÀÆ÷"	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\XunJie\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XunJie.Association.HTML\DefaultIcon	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\XunJie\	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\command	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 4120	728	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	83
PID 728 wrote to memory of 4120	728	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	83
PID 728 wrote to memory of 4120	728	51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe	83

C:\Users\Admin\AppData\Local\Temp\51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe
"C:\Users\Admin\AppData\Local\Temp\51017654059328a4f0215e5abc1cb26e726fdcad8fe55d928effcebd15865f9e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ydlem.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ydlem.bat

Filesize
512B

MD5
30db898a14e0934dec26174c9ce084cb

SHA1
5a93cd892e56be6917f40aa8c3d4d31cbe539ef2

SHA256
4dcd26992a4333566da56204c2f142018731b88e48b757e43f3d50345731ca7e

SHA512
5d3de06624e1b894a4bd70f98efcce36cbf1112e568ba1f8b88910d0099d2fc801530c92bb8b20800151b6cedbf4c867a98f24d6a4f3eeab0e94e380a6d0160c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ydlem.tmp

Filesize
32KB

MD5
bff338b7d8562a07c1a32113759aa001

SHA1
fa60948fe1a119507e1267f7a6641e38e84d9c86

SHA256
84599380fe36dde5d5543fba5e84f0efb7f8b2b40f5e3e09a9bd8663296b6d75

SHA512
a9f4014e1c900e292a520a70b71ed1d2333abd311910ae6c633e73189806873110e6b90fcc7bb20b8f2a07ebbedefa69250c1d87e4f0c013eb29088cde98f869

Download Submit