Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 03:34
Behavioral task
behavioral1
Sample
upx.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
upx.exe
-
Size
69KB
-
MD5
a230d428e97911ce6959e1463d781257
-
SHA1
0946c13059bf98fd3aacefd0b2681a42b95292cd
-
SHA256
c8e088feb7de05c3852af588c1a440f61d06870a93b07a3c6b7e2c12c9d55b12
-
SHA512
089f7f6e979729ba037a19510be160d1c407c712fa01614815ce2427ff6c8fe7fa80a2cb673a36611dc37734aba63f7c87832c3848ac9ce011343c0e15b7aa68
-
SSDEEP
1536:KWEyI4XFyV0UUIRiZAkupj9bIu9uLhQSOIcoFqXgG:KWnIiyVxRiij9bIYYhdOBuqXz
Score
10/10
Malware Config
Extracted
Family
xworm
C2
45.83.246.140:30120
Attributes
-
Install_directory
%AppData%
-
install_file
runtime.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/536-0-0x0000000000930000-0x0000000000948000-memory.dmp family_xworm behavioral2/files/0x00060000000006cf-23.dat family_xworm -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runtime.lnk upx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runtime.lnk upx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime = "C:\\Users\\Admin\\AppData\\Roaming\\runtime.exe" upx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 536 upx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 536 upx.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3972 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 536 upx.exe Token: SeDebugPrivilege 3972 taskmgr.exe Token: SeSystemProfilePrivilege 3972 taskmgr.exe Token: SeCreateGlobalPrivilege 3972 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe 3972 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 536 upx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\upx.exe"C:\Users\Admin\AppData\Local\Temp\upx.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:536
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771B
MD56319f19bf0973d5cd140b30b094c5c4c
SHA142a7e6f52b59006ec75e298218660b5fe0b170ac
SHA2567da5b9a5811f7f17969c61f993c93db7d4c6d01a2e25a97d683ddefe2c76c986
SHA512baba197f2a82fde07fb2ee599f3a64140a4466dcc8883a142b179b0ec1359abad074cefe9626b4ebb9336a54754010b70fa348fa191ffc1665a728faab86efc6
-
Filesize
69KB
MD5a230d428e97911ce6959e1463d781257
SHA10946c13059bf98fd3aacefd0b2681a42b95292cd
SHA256c8e088feb7de05c3852af588c1a440f61d06870a93b07a3c6b7e2c12c9d55b12
SHA512089f7f6e979729ba037a19510be160d1c407c712fa01614815ce2427ff6c8fe7fa80a2cb673a36611dc37734aba63f7c87832c3848ac9ce011343c0e15b7aa68