657863a210016af574c75b32f00c012d47c3d96f53734dd5aa1b69d33256283e

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XWorm.V3.1.7z
Size

24.3MB
MD5

809fa0ce52950e65983d16bcc3803900
SHA1

ad8cb46e4f49ddf05c167ce63bf3e449c3bfe25a
SHA256

657863a210016af574c75b32f00c012d47c3d96f53734dd5aa1b69d33256283e
SHA512

3243db58db3f6fd67f58652b112dca78ce1111d57814ca29a62e7dcdecb296a06e0b22a3b08652cb11b49e058bff6914cd8da8877a0c918b7e35988f5f3b23df
SSDEEP

786432:RFzbmUlBS5bd09JYWzbCJ1/KJZWc17clFwvnuku9nZNG:RtbmUlBq5IYWz4NYAl+kbG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.7z	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2252	rundll32.exe
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2252	2444	cmd.exe	29
PID 2444 wrote to memory of 2252	2444	cmd.exe	29
PID 2444 wrote to memory of 2252	2444	cmd.exe	29
PID 2252 wrote to memory of 2892	2252	rundll32.exe	30
PID 2252 wrote to memory of 2892	2252	rundll32.exe	30
PID 2252 wrote to memory of 2892	2252	rundll32.exe	30
PID 2252 wrote to memory of 2892	2252	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\XWorm.V3.1.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XWorm.V3.1.7z
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.V3.1.7z"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ab61bedb4b90bea8cbe9cffe844bc90c

SHA1
1462b444b40dacec9f72f88b279f3c9f7482acc8

SHA256
daa1fa8bf284c205fd5c41d39e90c3a54a206cf09d6fa9688f8e4383ae3d60c6

SHA512
ad080e9aaa1b60d61e224abf0a6636977e135d80c9ce36d233ae7d12e49a1bfae49179b226b7f16a7f78e7b4644db4326316e90dc88480d27a9dc037fd5110c0

Download Submit