Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 13:15
Behavioral task
behavioral1
Sample
xmpp.exe
Resource
win7-20240611-en
General
-
Target
xmpp.exe
-
Size
322KB
-
MD5
08012e03be6f628b09e73c4a65614e88
-
SHA1
97f1690d23ce1f522469e9769e98ffa222b234b7
-
SHA256
5341e6d0abe6278fd72b162c267b82d3af20dbf7c407e24f70b99ea6235fa85d
-
SHA512
dfcdb8a1f7751b53cf7da5ad1d6a30609945425874e553fc2b792388356b2b3c8cbf65afb4143aafa9e590d1dc8c3dc116a03e3f8726d5a6233aa687cf697b3f
-
SSDEEP
6144:+LV6Bta6dtJmakIM5iY/uQ/MwCUcMw5bUqNxyZ6QAbAj6gB4AVaHW+Gm6J0QPY:+LV6BtpmkqSwAJ8VAMj6U4AV5tJ0Qw
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
xmpp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsvc.exe" xmpp.exe -
Processes:
xmpp.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xmpp.exe -
Drops file in Program Files directory 2 IoCs
Processes:
xmpp.exedescription ioc process File created C:\Program Files (x86)\DDP Service\ddpsvc.exe xmpp.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsvc.exe xmpp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2968 schtasks.exe 2320 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
xmpp.exepid process 1844 xmpp.exe 1844 xmpp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
xmpp.exepid process 1844 xmpp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xmpp.exedescription pid process Token: SeDebugPrivilege 1844 xmpp.exe Token: SeDebugPrivilege 1844 xmpp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
xmpp.exedescription pid process target process PID 1844 wrote to memory of 2968 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2968 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2968 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2968 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2320 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2320 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2320 1844 xmpp.exe schtasks.exe PID 1844 wrote to memory of 2320 1844 xmpp.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xmpp.exe"C:\Users\Admin\AppData\Local\Temp\xmpp.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1999.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1A17.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1999.tmpFilesize
1KB
MD5f6f3f22a55c23847f3ec537d9d50d61b
SHA121d7ee9cbbdc0103676e386f502f7c91a88ae10a
SHA25623e92430a460ee36367a7239595be60e4fa0cad39688d1dad10b3e5a2788882f
SHA512f54d5488114af2a87e7cd722a84301161242dc664093ff996a41d9465d7c0702f0aae6fa124a94d64cfee9cedf563e340559189b26baf53fe05ad0814e6de566
-
C:\Users\Admin\AppData\Local\Temp\tmp1A17.tmpFilesize
1KB
MD52a91b19749346c8f783945a00a5050d7
SHA166c61f7802ac5b83aae26f6042575717209bae3e
SHA2560b0a294877234b2406c573060ff13262da0414485c0954ef8961a9429d9f7fb1
SHA512c5b044a2bda0ad0d38fb57ffb54611381f05ef6ef2f14481d00c278ecefda2d963ef41b2ef6e2bb16718fb8e5aa859bf2b9f870bf3ba8959c5a6b5b03aa53622
-
memory/1844-0-0x00000000740E1000-0x00000000740E2000-memory.dmpFilesize
4KB
-
memory/1844-1-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB
-
memory/1844-2-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB
-
memory/1844-10-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB