Overview

overview

10

Static

static

10

system32.exe

windows7-x64

10

system32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2023 05:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    system32.exe

  • Size

    39KB

  • MD5

    0b91a67678d1d12445c29e24a4285c83

  • SHA1

    45ae543b41192d69ec7596234944435ae64c8d43

  • SHA256

    20e9aef5dc8b431c1e7e1c93fd0c4173c0bea2965df8226a47d929f273e0a377

  • SHA512

    5dc7a0f897e21a0b9e92e717074782dca8b98d3508684923c7582eb8a995a442501154fa1680c557379abf3b442d9aa5884938225ad567c95e8d085ac5159f62

  • SSDEEP

    768:+e8A4X7P7DHnKPCt/kXF8UjF5Ph9C2w6FOwhDICFHCgcO:FQXXzB1wKUFD9Vw6FOwaMiE

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

display-trade.at.ply.gg:25685

Mutex

9ZiSQ5Pyj3yT9BMp

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\system32.exe
    "C:\Users\Admin\AppData\Local\Temp\system32.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system32.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\system32.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2016
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system32" /tr "C:\Users\Admin\AppData\Roaming\system32.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1904
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {B3D78B14-6843-4784-B5EF-35BF92F0242B} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
    1⤵
      PID:1168
    • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\Desktop\UnregisterApprove.ppt"
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:292

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        99745bb8aceefbae440159d62054fd15

        SHA1

        bcc90e9e4a714b3623becfaf65e6d294f3c3ce19

        SHA256

        2f6fcccd99f88298ecb78d02287458b9999e37072741a6e20a98204b89f7283c

        SHA512

        5838ea5a6fec60f180d8510087c54d10b04a6b3dc49a21843355c408f3378f82a8de6828b64259b4dcf6567919bd5acf3488f4ae32ae829e2c02bd5dd8cf2b9b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        99745bb8aceefbae440159d62054fd15

        SHA1

        bcc90e9e4a714b3623becfaf65e6d294f3c3ce19

        SHA256

        2f6fcccd99f88298ecb78d02287458b9999e37072741a6e20a98204b89f7283c

        SHA512

        5838ea5a6fec60f180d8510087c54d10b04a6b3dc49a21843355c408f3378f82a8de6828b64259b4dcf6567919bd5acf3488f4ae32ae829e2c02bd5dd8cf2b9b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DTJSPJQ097YDKOHV5VQA.temp
        Filesize

        7KB

        MD5

        99745bb8aceefbae440159d62054fd15

        SHA1

        bcc90e9e4a714b3623becfaf65e6d294f3c3ce19

        SHA256

        2f6fcccd99f88298ecb78d02287458b9999e37072741a6e20a98204b89f7283c

        SHA512

        5838ea5a6fec60f180d8510087c54d10b04a6b3dc49a21843355c408f3378f82a8de6828b64259b4dcf6567919bd5acf3488f4ae32ae829e2c02bd5dd8cf2b9b

        Download Submit

      • memory/740-62-0x0000000001F90000-0x0000000001F98000-memory.dmp

        Filesize

        32KB

        Download

      • memory/740-63-0x0000000002500000-0x0000000002580000-memory.dmp

        Filesize

        512KB

        Download

      • memory/740-64-0x000000000250B000-0x0000000002542000-memory.dmp

        Filesize

        220KB

        Download

      • memory/740-61-0x0000000002500000-0x0000000002580000-memory.dmp

        Filesize

        512KB

        Download

      • memory/740-60-0x000000001B340000-0x000000001B622000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/868-85-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/880-72-0x0000000002890000-0x0000000002910000-memory.dmp

        Filesize

        512KB

        Download

      • memory/880-71-0x00000000024A0000-0x00000000024A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/880-73-0x000000000289B000-0x00000000028D2000-memory.dmp

        Filesize

        220KB

        Download

      • memory/880-70-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/1416-54-0x0000000000B80000-0x0000000000B90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1416-55-0x000000001A7B0000-0x000000001A830000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2016-79-0x0000000002474000-0x0000000002477000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2016-80-0x000000000247B000-0x00000000024B2000-memory.dmp

        Filesize

        220KB

        Download