Overview
overview
10Static
static
10XPloit.zip
windows7-x64
3XPloit.zip
windows10-2004-x64
1ForlornApi.dll
windows7-x64
1ForlornApi.dll
windows10-2004-x64
1ForlornInject.dll
windows7-x64
1ForlornInject.dll
windows10-2004-x64
7XPloit.deps.json
windows7-x64
3XPloit.deps.json
windows10-2004-x64
3XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3XPloit.pdb
windows7-x64
3XPloit.pdb
windows10-2004-x64
3XPloit.run...g.json
windows7-x64
3XPloit.run...g.json
windows10-2004-x64
3workspace/IY_FE.iy
windows7-x64
3workspace/IY_FE.iy
windows10-2004-x64
3workspace/...s.json
windows7-x64
3workspace/...s.json
windows10-2004-x64
3Resubmissions
21-12-2024 17:42
241221-v9y3xavlaz 1020-12-2024 23:19
241220-3bbtqawpat 1020-12-2024 19:29
241220-x7fjwssqdm 10Analysis
-
max time kernel
75s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 17:42
Behavioral task
behavioral1
Sample
XPloit.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
XPloit.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ForlornApi.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
ForlornApi.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ForlornInject.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
ForlornInject.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
XPloit.deps.json
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
XPloit.deps.json
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
XPloit.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
XPloit.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
XPloit.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
XPloit.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
main.pyc
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
main.pyc
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
XPloit.pdb
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
XPloit.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
XPloit.runtimeconfig.json
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
XPloit.runtimeconfig.json
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
workspace/IY_FE.iy
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
workspace/IY_FE.iy
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
workspace/MercurySettings.json
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
workspace/MercurySettings.json
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
XPloit.zip
-
Size
23.9MB
-
MD5
df5931935ffe284ca5b40791607e7a4c
-
SHA1
262399853d05ece01f740d1e820aa892b065b1bd
-
SHA256
3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de
-
SHA512
38ac5f801f73714c840e16c8513b3c4f2d29815f042585a61c06830a76c1cae0e7e295241be686ae2d5f4bd19503ee9e69dadd611b1389d6ea9018553df785f7
-
SSDEEP
393216:OH+kig1whmEJ+oUAgHRsP56jvR3vJ0RPaati4b8sVNSCoOYhkhalpMJpQl+25+:sB1w/J+oUANMj53vOxavKxoqhMgpw+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\edit\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.iy rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\edit\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\json_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.iy\ = "iy_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iy_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe -
Opens file in notepad (likely ransom note) 3 IoCs
pid Process 2976 NOTEPAD.EXE 1696 NOTEPAD.EXE 576 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2896 7zFM.exe 2664 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 2896 7zFM.exe Token: 35 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe Token: SeSecurityPrivilege 2896 7zFM.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 2896 7zFM.exe 1696 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2796 2896 7zFM.exe 30 PID 2896 wrote to memory of 2796 2896 7zFM.exe 30 PID 2896 wrote to memory of 2796 2896 7zFM.exe 30 PID 2896 wrote to memory of 2624 2896 7zFM.exe 31 PID 2896 wrote to memory of 2624 2896 7zFM.exe 31 PID 2896 wrote to memory of 2624 2896 7zFM.exe 31 PID 2896 wrote to memory of 1312 2896 7zFM.exe 32 PID 2896 wrote to memory of 1312 2896 7zFM.exe 32 PID 2896 wrote to memory of 1312 2896 7zFM.exe 32 PID 2896 wrote to memory of 2664 2896 7zFM.exe 33 PID 2896 wrote to memory of 2664 2896 7zFM.exe 33 PID 2896 wrote to memory of 2664 2896 7zFM.exe 33 PID 2664 wrote to memory of 576 2664 rundll32.exe 35 PID 2664 wrote to memory of 576 2664 rundll32.exe 35 PID 2664 wrote to memory of 576 2664 rundll32.exe 35 PID 2896 wrote to memory of 1972 2896 7zFM.exe 37 PID 2896 wrote to memory of 1972 2896 7zFM.exe 37 PID 2896 wrote to memory of 1972 2896 7zFM.exe 37 PID 2896 wrote to memory of 2936 2896 7zFM.exe 38 PID 2896 wrote to memory of 2936 2896 7zFM.exe 38 PID 2896 wrote to memory of 2936 2896 7zFM.exe 38 PID 2936 wrote to memory of 2976 2936 rundll32.exe 39 PID 2936 wrote to memory of 2976 2936 rundll32.exe 39 PID 2936 wrote to memory of 2976 2936 rundll32.exe 39 PID 2896 wrote to memory of 1696 2896 7zFM.exe 41 PID 2896 wrote to memory of 1696 2896 7zFM.exe 41 PID 2896 wrote to memory of 1696 2896 7zFM.exe 41
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XPloit.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05B9E2B6\XPloit.deps.json2⤵
- Modifies registry class
PID:2796
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05BD8E86\XPloit.deps.json2⤵
- Modifies registry class
PID:2624
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05B1AFE6\MercurySettings.json2⤵
- Modifies registry class
PID:1312
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05B9EBE6\MercurySettings.json2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO05B9EBE6\MercurySettings.json3⤵
- Opens file in notepad (likely ransom note)
PID:576
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05B664C6\IY_FE.iy2⤵
- Modifies registry class
PID:1972
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO05B3C3C6\IY_FE.iy2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO05B3C3C6\IY_FE.iy3⤵
- Opens file in notepad (likely ransom note)
PID:2976
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO05B6EF37\IY_FE.iy2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1696
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55430cd099b8699e8bf8692b1ee282372
SHA1e44b62849519db8a77b5ce6f8e5572e1edf2d041
SHA256738277b369c0cfdec8ad0eb24aace538f19785ea134541657661ac80802730d7
SHA5129126e43feaad90e61b7dc7eeff30616701bf8f85f4de669bed7acd10a0b01c97dd35276d0de42ad41041d30441c9ea9cd130450a5db1ead4c0aa06a4494f605c
-
Filesize
16B
MD5be12004ab076e82cb7b308cf1322bbf7
SHA10de6f88fe43b9698ade3f6063c1b5a815c43b7f3
SHA256ee09e40269075114a05082e03c87e115939ebc488d9ecced1a5fb74106a76ed7
SHA512f66f8782cfed28687e860ec2f3806795654f82f50604a86f7b20657f04efe5eb5746aa7451042017d53f2fd03d9233d3f43526c2f90ac5c830e1ad3e82a27d49