Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 16:35
Behavioral task
behavioral1
Sample
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe
Resource
win10v2004-20240412-en
General
-
Target
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe
-
Size
34KB
-
MD5
b1277c96cd2cabd50382318e95179713
-
SHA1
5da077cec493cfee0d9ec1905d9882efa8a8d284
-
SHA256
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11
-
SHA512
4d28ed36ce3d3bbc6d96e4ed76e95604edd10a2eabf60001dcaf611269358e70bebe71a6d2ebfa2a747c3e2feac9e8f3c2f913b3fabdaab2b327c4f46bafd36e
-
SSDEEP
768:/pabA1ZUxNkLACVVickNVFy19JR6aO/hnt:fn2Nk8hcAF49JR6aO/v
Malware Config
Extracted
xworm
3.1
dzn.ddns.net:5552
mT1l25650AkcpwGy
-
Install_directory
%Temp%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4148-0-0x0000000000310000-0x000000000031E000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe -
Drops startup file 2 IoCs
Processes:
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.lnk fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.lnk fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe" fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1664 powershell.exe 1664 powershell.exe 1408 powershell.exe 1408 powershell.exe 2740 powershell.exe 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exepowershell.exepowershell.exepowershell.exefe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exefe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exedescription pid process Token: SeDebugPrivilege 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe Token: SeDebugPrivilege 3924 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe Token: SeDebugPrivilege 3628 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exedescription pid process target process PID 4148 wrote to memory of 1664 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 1664 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 1408 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 1408 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 2740 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 2740 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe powershell.exe PID 4148 wrote to memory of 2592 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe schtasks.exe PID 4148 wrote to memory of 2592 4148 fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe"C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11" /tr "C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exeC:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exeC:\Users\Admin\AppData\Local\Temp\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11.exe.logFilesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD571fa55c67a762ba70e40011153e19b3c
SHA1a36d2bb4802a8ec7db1a68de5f0c3d6007987492
SHA256b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291
SHA51232760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e2da2d9f90026fdcbf934311a18284a2
SHA156de674db9fb5e29a62562191b498d976228dfd4
SHA256199babd6ffc35f86a277f477aa21cc4242a5650779f79c64928eb469c857183e
SHA512c7ed9f7540a927186f6192c71a18e41d43f87a6b7c578d0bbc63718a9f5ff3e4e597cf4ae18b2cb50ee5730d4360b45994a5931c648291f3250fd0ddfbb70bb3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d8cb3e9459807e35f02130fad3f9860d
SHA15af7f32cb8a30e850892b15e9164030a041f4bd6
SHA2562b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xih33ke.jxu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1408-28-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/1408-33-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/1408-30-0x0000021B989B0000-0x0000021B989C0000-memory.dmpFilesize
64KB
-
memory/1408-29-0x0000021B989B0000-0x0000021B989C0000-memory.dmpFilesize
64KB
-
memory/1664-14-0x000001A6374B0000-0x000001A6374D2000-memory.dmpFilesize
136KB
-
memory/1664-2-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/1664-17-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/1664-8-0x000001A635190000-0x000001A6351A0000-memory.dmpFilesize
64KB
-
memory/1664-13-0x000001A635190000-0x000001A6351A0000-memory.dmpFilesize
64KB
-
memory/2740-48-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/2740-45-0x0000013551B70000-0x0000013551B80000-memory.dmpFilesize
64KB
-
memory/2740-44-0x0000013551B70000-0x0000013551B80000-memory.dmpFilesize
64KB
-
memory/2740-43-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/3628-58-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/3628-59-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/3924-53-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/3924-55-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/4148-0-0x0000000000310000-0x000000000031E000-memory.dmpFilesize
56KB
-
memory/4148-50-0x000000001B1E0000-0x000000001B1F0000-memory.dmpFilesize
64KB
-
memory/4148-51-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB
-
memory/4148-52-0x000000001B1E0000-0x000000001B1F0000-memory.dmpFilesize
64KB
-
memory/4148-1-0x00007FFCDB3E0000-0x00007FFCDBEA1000-memory.dmpFilesize
10.8MB