Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 03:34
Behavioral task
behavioral1
Sample
upx.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
upx.exe
-
Size
69KB
-
MD5
a230d428e97911ce6959e1463d781257
-
SHA1
0946c13059bf98fd3aacefd0b2681a42b95292cd
-
SHA256
c8e088feb7de05c3852af588c1a440f61d06870a93b07a3c6b7e2c12c9d55b12
-
SHA512
089f7f6e979729ba037a19510be160d1c407c712fa01614815ce2427ff6c8fe7fa80a2cb673a36611dc37734aba63f7c87832c3848ac9ce011343c0e15b7aa68
-
SSDEEP
1536:KWEyI4XFyV0UUIRiZAkupj9bIu9uLhQSOIcoFqXgG:KWnIiyVxRiij9bIYYhdOBuqXz
Score
10/10
Malware Config
Extracted
Family
xworm
C2
45.83.246.140:30120
Attributes
-
Install_directory
%AppData%
-
install_file
runtime.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2240-1-0x00000000003F0000-0x0000000000408000-memory.dmp family_xworm -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runtime.lnk upx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runtime.lnk upx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\runtime = "C:\\Users\\Admin\\AppData\\Roaming\\runtime.exe" upx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2240 upx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 upx.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2260 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2240 upx.exe Token: SeDebugPrivilege 2260 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2240 upx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\upx.exe"C:\Users\Admin\AppData\Local\Temp\upx.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2240
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2260