Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2024, 16:33
Behavioral task
behavioral1
Sample
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe
-
Size
20KB
-
MD5
59502c980b553ee91bcc20ea6fa720f8
-
SHA1
f4db3f200929072aad0c53f23dc357ab5b3099ab
-
SHA256
7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340
-
SHA512
9f76231a4c9a88018365d9f92b698242a13797a4c64f1cb4088437acb763e2ab58343bcd682caefd43ae2573c07441849e3755f9c63855cc9d0ef36ea49d1f40
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU9:9KE7pXaNJawcudoD7U7S5Ev9
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe -
Executes dropped EXE 1 IoCs
pid Process 4016 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
resource yara_rule behavioral2/memory/5088-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000023cb5-16.dat upx behavioral2/memory/5088-26-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4016-28-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xplorer\xplorer.exe 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe File created C:\Windows\xplorer\xplorer.exe 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe Token: SeDebugPrivilege 4016 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 4016 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5088 wrote to memory of 4512 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 83 PID 5088 wrote to memory of 4512 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 83 PID 5088 wrote to memory of 4512 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 83 PID 4512 wrote to memory of 2904 4512 cmd.exe 86 PID 4512 wrote to memory of 2904 4512 cmd.exe 86 PID 4512 wrote to memory of 2904 4512 cmd.exe 86 PID 5088 wrote to memory of 4016 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 87 PID 5088 wrote to memory of 4016 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 87 PID 5088 wrote to memory of 4016 5088 7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe"C:\Users\Admin\AppData\Local\Temp\7ad2cdfe244536e1770804b14822e67930598fbcb9c2ed8a04853a1733f46340.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EPURF.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD5e6b46b676d82c058be6a5f77f7981404
SHA1794c85be935e957bef383364ed8c65a2e32942f8
SHA256152baee63a172b58eb32d8ddd795b9179201e6f68a45aeafe9b676c20a77da05
SHA5129385c959eab65cedca4db1542cd088e96b45e0140a3626a1b956ab3d8e4ea19a823930077355a40a39ce605c36ecd41be6cff64a3fbcebf2b0c0c6f429db8721