Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-12-2024 16:33
Behavioral task
behavioral1
Sample
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
-
Size
20KB
-
MD5
59502c980b553ee91bcc20ea6fa720f8
-
SHA1
f4db3f200929072aad0c53f23dc357ab5b3099ab
-
SHA256
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340
-
SHA512
9f76231a4c9a88018365d9f92b698242a13797a4c64f1cb4088437acb763e2ab58343bcd682caefd43ae2573c07441849e3755f9c63855cc9d0ef36ea49d1f40
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU9:9KE7pXaNJawcudoD7U7S5Ev9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
xplorer.exepid Process 2800 xplorer.exe -
Loads dropped DLL 5 IoCs
Processes:
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exepid Process 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Processes:
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xplorer.exe -
Processes:
resource yara_rule behavioral1/memory/2484-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000016814-25.dat upx behavioral1/memory/2484-27-0x0000000003440000-0x000000000344B000-memory.dmp upx behavioral1/memory/2484-44-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2800-46-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exedescription ioc Process File opened for modification C:\Windows\xplorer\xplorer.exe 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe File created C:\Windows\xplorer\xplorer.exe 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
reg.exexplorer.exe7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
xplorer.exedescription pid Process Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe Token: SeDebugPrivilege 2800 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exexplorer.exepid Process 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 2800 xplorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.execmd.exedescription pid Process procid_target PID 2484 wrote to memory of 2300 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 30 PID 2484 wrote to memory of 2300 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 30 PID 2484 wrote to memory of 2300 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 30 PID 2484 wrote to memory of 2300 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 30 PID 2300 wrote to memory of 2720 2300 cmd.exe 32 PID 2300 wrote to memory of 2720 2300 cmd.exe 32 PID 2300 wrote to memory of 2720 2300 cmd.exe 32 PID 2300 wrote to memory of 2720 2300 cmd.exe 32 PID 2484 wrote to memory of 2800 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 33 PID 2484 wrote to memory of 2800 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 33 PID 2484 wrote to memory of 2800 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 33 PID 2484 wrote to memory of 2800 2484 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe"C:\Users\Admin\AppData\Local\Temp\7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RDBFA.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2720
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD59eb48c8db96f50802ff5aff6b6e5ceb8
SHA15d1fbec7b1306c0f9c32ccda8e1a27d10f68c25b
SHA256512b1ccb414a238a3697afd44d3e6828302b8564d876d848cdbf2c0719c8e1a8
SHA5125e1765d87182f396ad6ea48e14567a7106c0c388d34ec6788374e7534440e1f6ae42a3ddd72af3b5c53734c86c0d70ba2c3ade97d5d2273d87fe6e9a64d13634