Overview

overview

10

Static

static

10

Siege Anti-Recoil.exe

windows7-x64

10

Siege Anti-Recoil.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    245s
  • max time network
    286s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 15:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Siege Anti-Recoil.exe

  • Size

    382KB

  • MD5

    8927b4c1ff38af9da8ba5eb8fd83137b

  • SHA1

    c2af615ba8ec9a25f69f2ebb46aa2e7ac7bd0ca1

  • SHA256

    ea55d13d71e1a071cf78a9c29b402b1d743f693a41bd1038b0f37b6d84c9cfb2

  • SHA512

    3a20fe9e74618310a2da5ab81b2d4de77f31fa3716d608b7c40190da8f70664ef9094b62909aaea7ea47ad47566aeec18979afa592c56ace88497f34ca41705d

  • SSDEEP

    1536:B97Xq5MP31toJnmId6+mg7PbuhB2M4Ojzlro:BAg3MZd6+mCbYmOjG

Score
10/10
xwormpersistenceransomwarerattrojan

Malware Config

Extracted

Family

xworm

C2

uk2.localto.net:37847

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Google.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Siege Anti-Recoil.exe
    "C:\Users\Admin\AppData\Local\Temp\Siege Anti-Recoil.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
      2⤵
        PID:2612
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2204
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3780 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:2104
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
          1⤵
            PID:3104
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5416 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:2044
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5556 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
              1⤵
                PID:2268
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5280 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:2832

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
                  Filesize

                  16B

                  MD5

                  d012e5555ae6936cbe76b0edf9b0da69

                  SHA1

                  0a80fe68cdd19432d8f4ccae4b505613064f1966

                  SHA256

                  7a35c4144ba71bf57b0fe01b116314ff31f3765cd6667c3d48def6fe1c4af861

                  SHA512

                  920b93ad09eddab8b03be79bc8813abce6beaa0cbb37ff0a8d85c92c8940ce003bb03d967eaa84d22b01e00aabfab26e16c2d41fb2c56bd60bf08171cb130de6

                  Download Submit

                • memory/4528-0-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4528-1-0x0000000000770000-0x0000000000786000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/4528-2-0x0000000001060000-0x0000000001070000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4528-7-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4528-8-0x0000000001060000-0x0000000001070000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4528-10-0x0000000001050000-0x000000000105C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4528-172-0x000000001BCC0000-0x000000001BCCE000-memory.dmp

                  Filesize

                  56KB

                  Download