Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 17:33
Behavioral task
behavioral1
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win10v2004-20240412-en
General
-
Target
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
-
Size
70KB
-
MD5
109adf5a32829b151d536e30a81ee96b
-
SHA1
dc23006a97e7d5bc34eedec563432e63ed6a226a
-
SHA256
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
-
SHA512
74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
-
SSDEEP
1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
Malware Config
Extracted
xworm
involved-hurt.gl.at.ply.gg:35238
-
Install_directory
%LocalAppData%
-
install_file
WindowsHealthSystem.exe
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1992-0-0x00000000008C0000-0x00000000008D8000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe family_xworm behavioral1/memory/2128-62-0x0000000000F80000-0x0000000000F98000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHealthSystem.lnk 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHealthSystem.lnk 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe -
Executes dropped EXE 2 IoCs
Processes:
WindowsHealthSystem.exeWindowsHealthSystem.exepid process 2128 WindowsHealthSystem.exe 852 WindowsHealthSystem.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHealthSystem = "C:\\Users\\Admin\\AppData\\Local\\WindowsHealthSystem.exe" 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exepid process 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exe4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exepid process 2976 powershell.exe 2648 powershell.exe 2400 powershell.exe 1656 powershell.exe 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exepowershell.exepowershell.exepowershell.exepowershell.exeWindowsHealthSystem.exeWindowsHealthSystem.exedescription pid process Token: SeDebugPrivilege 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 2648 powershell.exe Token: SeDebugPrivilege 2400 powershell.exe Token: SeDebugPrivilege 1656 powershell.exe Token: SeDebugPrivilege 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe Token: SeDebugPrivilege 2128 WindowsHealthSystem.exe Token: SeDebugPrivilege 852 WindowsHealthSystem.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exepid process 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exetaskeng.exedescription pid process target process PID 1992 wrote to memory of 2976 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2976 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2976 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2648 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2648 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2648 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2400 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2400 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 2400 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 1656 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 1656 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 1656 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe powershell.exe PID 1992 wrote to memory of 1580 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe schtasks.exe PID 1992 wrote to memory of 1580 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe schtasks.exe PID 1992 wrote to memory of 1580 1992 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe schtasks.exe PID 1668 wrote to memory of 2128 1668 taskeng.exe WindowsHealthSystem.exe PID 1668 wrote to memory of 2128 1668 taskeng.exe WindowsHealthSystem.exe PID 1668 wrote to memory of 2128 1668 taskeng.exe WindowsHealthSystem.exe PID 1668 wrote to memory of 852 1668 taskeng.exe WindowsHealthSystem.exe PID 1668 wrote to memory of 852 1668 taskeng.exe WindowsHealthSystem.exe PID 1668 wrote to memory of 852 1668 taskeng.exe WindowsHealthSystem.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe"C:\Users\Admin\AppData\Local\Temp\4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsHealthSystem.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsHealthSystem" /tr "C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {165ED6C8-B008-4F6E-BCEF-51EA78FB2FE1} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\WindowsHealthSystem.exeC:\Users\Admin\AppData\Local\WindowsHealthSystem.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\WindowsHealthSystem.exeC:\Users\Admin\AppData\Local\WindowsHealthSystem.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WindowsHealthSystem.exeFilesize
70KB
MD5109adf5a32829b151d536e30a81ee96b
SHA1dc23006a97e7d5bc34eedec563432e63ed6a226a
SHA2564b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
SHA51274e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5c58e8a7366da0a2deba3d9c7fcfb1f7a
SHA13413889c3ffa7a7745f45ebc7e059bd19f734326
SHA256e585814f99fa10d1a3b02afbc2b89d96b0804f411cf06889aad07d97afb01dde
SHA512050c13efb68ef0306930794027a72dbc898629837d4ed05d8c98101f0d0eb953e6eea2829a9897e1158520820ec1bb2a5f197a98a7cbabcd80e39d057bd9f0a7
-
memory/852-67-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/852-66-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/1656-47-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/1656-45-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/1656-48-0x0000000002CB0000-0x0000000002D30000-memory.dmpFilesize
512KB
-
memory/1656-51-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/1656-49-0x0000000002CB0000-0x0000000002D30000-memory.dmpFilesize
512KB
-
memory/1656-46-0x0000000002CB0000-0x0000000002D30000-memory.dmpFilesize
512KB
-
memory/1992-0-0x00000000008C0000-0x00000000008D8000-memory.dmpFilesize
96KB
-
memory/1992-57-0x000000001B020000-0x000000001B0A0000-memory.dmpFilesize
512KB
-
memory/1992-56-0x000000001B020000-0x000000001B0A0000-memory.dmpFilesize
512KB
-
memory/1992-50-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/1992-1-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/2128-62-0x0000000000F80000-0x0000000000F98000-memory.dmpFilesize
96KB
-
memory/2128-63-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/2128-64-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/2400-38-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2400-39-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2400-37-0x0000000002CCB000-0x0000000002D32000-memory.dmpFilesize
412KB
-
memory/2400-35-0x0000000002CC0000-0x0000000002D40000-memory.dmpFilesize
512KB
-
memory/2400-34-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2400-36-0x0000000002CC4000-0x0000000002CC7000-memory.dmpFilesize
12KB
-
memory/2648-28-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/2648-25-0x0000000002D30000-0x0000000002DB0000-memory.dmpFilesize
512KB
-
memory/2648-26-0x0000000002D30000-0x0000000002DB0000-memory.dmpFilesize
512KB
-
memory/2648-27-0x0000000002D30000-0x0000000002DB0000-memory.dmpFilesize
512KB
-
memory/2648-24-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/2648-23-0x0000000002D30000-0x0000000002DB0000-memory.dmpFilesize
512KB
-
memory/2648-21-0x000007FEEDCF0000-0x000007FEEE68D000-memory.dmpFilesize
9.6MB
-
memory/2648-22-0x0000000002390000-0x0000000002398000-memory.dmpFilesize
32KB
-
memory/2648-20-0x000000001B630000-0x000000001B912000-memory.dmpFilesize
2.9MB
-
memory/2976-14-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2976-13-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/2976-10-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2976-11-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/2976-12-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/2976-9-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/2976-8-0x000007FEEE690000-0x000007FEEF02D000-memory.dmpFilesize
9.6MB
-
memory/2976-7-0x0000000001DA0000-0x0000000001DA8000-memory.dmpFilesize
32KB
-
memory/2976-6-0x000000001B5F0000-0x000000001B8D2000-memory.dmpFilesize
2.9MB