Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 08:37
Static task
static1
Behavioral task
behavioral1
Sample
New_Project_1 (2).exe
Resource
win7-20240221-en
General
-
Target
New_Project_1 (2).exe
-
Size
486KB
-
MD5
330f592f3a03c5e2c2ed4593d227f1a8
-
SHA1
55957a8e8d405569c655923dd9414c4ec6c45a0d
-
SHA256
0f10ed177734b40d0ca45eed258f8c3ca585323e32db8f3cab7387b61de0e679
-
SHA512
497f9308a49eb1e9451675f447c5774cbaf267dd77b69e1ab494609feca17a20224ac707e54abcb090ee90e1e8187e9fa681c200bcec97ac1bc36b0ce38d15c2
-
SSDEEP
12288:cWjF6EjvVYEaZ1hJcSx3ThB6xL3s7H4sn4/OxJrinEXL/sT:p68aZ1hlxlay5HdCuL
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1239139511359897700/no9NKxq5Y0T8pWT8XT2sOPqegxvgFUODOTwovbkwjhDGUE5-JgfcJdGO-V3YrtPZiVPB
Extracted
xworm
reference-elliott.gl.at.ply.gg:37420
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
Signatures
-
Detect Umbral payload 3 IoCs
resource yara_rule behavioral1/memory/2980-0-0x0000000000400000-0x000000000047C000-memory.dmp family_umbral behavioral1/files/0x0037000000014b4c-9.dat family_umbral behavioral1/memory/2572-15-0x00000000009D0000-0x0000000000A10000-memory.dmp family_umbral -
Detect Xworm Payload 4 IoCs
resource yara_rule behavioral1/memory/2980-0-0x0000000000400000-0x000000000047C000-memory.dmp family_xworm behavioral1/files/0x000c000000012674-3.dat family_xworm behavioral1/memory/2932-14-0x0000000001350000-0x000000000136C000-memory.dmp family_xworm behavioral1/memory/1916-46-0x00000000012C0000-0x00000000012DC000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 300 powershell.exe 2724 powershell.exe 1676 powershell.exe 1732 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 1.exe -
Executes dropped EXE 3 IoCs
pid Process 2932 1.exe 2572 2.exe 1916 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2980 New_Project_1 (2).exe 2980 New_Project_1 (2).exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe" 1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 632 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1872 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 300 powershell.exe 2724 powershell.exe 1676 powershell.exe 1732 powershell.exe 2932 1.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2932 1.exe Token: SeDebugPrivilege 2572 2.exe Token: SeIncreaseQuotaPrivilege 2448 wmic.exe Token: SeSecurityPrivilege 2448 wmic.exe Token: SeTakeOwnershipPrivilege 2448 wmic.exe Token: SeLoadDriverPrivilege 2448 wmic.exe Token: SeSystemProfilePrivilege 2448 wmic.exe Token: SeSystemtimePrivilege 2448 wmic.exe Token: SeProfSingleProcessPrivilege 2448 wmic.exe Token: SeIncBasePriorityPrivilege 2448 wmic.exe Token: SeCreatePagefilePrivilege 2448 wmic.exe Token: SeBackupPrivilege 2448 wmic.exe Token: SeRestorePrivilege 2448 wmic.exe Token: SeShutdownPrivilege 2448 wmic.exe Token: SeDebugPrivilege 2448 wmic.exe Token: SeSystemEnvironmentPrivilege 2448 wmic.exe Token: SeRemoteShutdownPrivilege 2448 wmic.exe Token: SeUndockPrivilege 2448 wmic.exe Token: SeManageVolumePrivilege 2448 wmic.exe Token: 33 2448 wmic.exe Token: 34 2448 wmic.exe Token: 35 2448 wmic.exe Token: SeIncreaseQuotaPrivilege 2448 wmic.exe Token: SeSecurityPrivilege 2448 wmic.exe Token: SeTakeOwnershipPrivilege 2448 wmic.exe Token: SeLoadDriverPrivilege 2448 wmic.exe Token: SeSystemProfilePrivilege 2448 wmic.exe Token: SeSystemtimePrivilege 2448 wmic.exe Token: SeProfSingleProcessPrivilege 2448 wmic.exe Token: SeIncBasePriorityPrivilege 2448 wmic.exe Token: SeCreatePagefilePrivilege 2448 wmic.exe Token: SeBackupPrivilege 2448 wmic.exe Token: SeRestorePrivilege 2448 wmic.exe Token: SeShutdownPrivilege 2448 wmic.exe Token: SeDebugPrivilege 2448 wmic.exe Token: SeSystemEnvironmentPrivilege 2448 wmic.exe Token: SeRemoteShutdownPrivilege 2448 wmic.exe Token: SeUndockPrivilege 2448 wmic.exe Token: SeManageVolumePrivilege 2448 wmic.exe Token: 33 2448 wmic.exe Token: 34 2448 wmic.exe Token: 35 2448 wmic.exe Token: SeDebugPrivilege 300 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 2932 1.exe Token: SeDebugPrivilege 1916 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2932 1.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2932 2980 New_Project_1 (2).exe 28 PID 2980 wrote to memory of 2932 2980 New_Project_1 (2).exe 28 PID 2980 wrote to memory of 2932 2980 New_Project_1 (2).exe 28 PID 2980 wrote to memory of 2932 2980 New_Project_1 (2).exe 28 PID 2980 wrote to memory of 2572 2980 New_Project_1 (2).exe 29 PID 2980 wrote to memory of 2572 2980 New_Project_1 (2).exe 29 PID 2980 wrote to memory of 2572 2980 New_Project_1 (2).exe 29 PID 2980 wrote to memory of 2572 2980 New_Project_1 (2).exe 29 PID 2572 wrote to memory of 2448 2572 2.exe 30 PID 2572 wrote to memory of 2448 2572 2.exe 30 PID 2572 wrote to memory of 2448 2572 2.exe 30 PID 2932 wrote to memory of 300 2932 1.exe 33 PID 2932 wrote to memory of 300 2932 1.exe 33 PID 2932 wrote to memory of 300 2932 1.exe 33 PID 2932 wrote to memory of 2724 2932 1.exe 35 PID 2932 wrote to memory of 2724 2932 1.exe 35 PID 2932 wrote to memory of 2724 2932 1.exe 35 PID 2932 wrote to memory of 1676 2932 1.exe 37 PID 2932 wrote to memory of 1676 2932 1.exe 37 PID 2932 wrote to memory of 1676 2932 1.exe 37 PID 2932 wrote to memory of 1732 2932 1.exe 39 PID 2932 wrote to memory of 1732 2932 1.exe 39 PID 2932 wrote to memory of 1732 2932 1.exe 39 PID 2932 wrote to memory of 632 2932 1.exe 41 PID 2932 wrote to memory of 632 2932 1.exe 41 PID 2932 wrote to memory of 632 2932 1.exe 41 PID 2868 wrote to memory of 1916 2868 taskeng.exe 44 PID 2868 wrote to memory of 1916 2868 taskeng.exe 44 PID 2868 wrote to memory of 1916 2868 taskeng.exe 44 PID 2932 wrote to memory of 1340 2932 1.exe 47 PID 2932 wrote to memory of 1340 2932 1.exe 47 PID 2932 wrote to memory of 1340 2932 1.exe 47 PID 2932 wrote to memory of 1948 2932 1.exe 49 PID 2932 wrote to memory of 1948 2932 1.exe 49 PID 2932 wrote to memory of 1948 2932 1.exe 49 PID 1948 wrote to memory of 1872 1948 cmd.exe 51 PID 1948 wrote to memory of 1872 1948 cmd.exe 51 PID 1948 wrote to memory of 1872 1948 cmd.exe 51 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Project_1 (2).exe"C:\Users\Admin\AppData\Local\Temp\New_Project_1 (2).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"3⤵
- Creates scheduled task(s)
PID:632
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"3⤵PID:1340
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD5C6.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:1872
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C0B98183-B1B1-41B9-84EC-008E35F7FE8C} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5ab84e99b80720507c7d0d97723eab4a3
SHA1495b529a471458545f89b0c175aab8284963d03d
SHA2567aec2d0153350974fe7a55626279c0a595383d8323f42e774c0b447f50b9269f
SHA51204c1380660b046752a25836fca7df0be6a93945a125adb98c6a887eb9c1bf21e1bb5c2c4432a66b4c33e7bd173893613a58456131c3d807e7a7f0131abe67e8f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD548cbd7f0abcc2000c9d9033d084abace
SHA1fa582725e05f9800c2f0269f066bcc7169cbf8d9
SHA256d497e05f2c6339d8b1bb5b26c548133ada1372ba04cf39061293c8eb31b92aa8
SHA5126a9223da4e44eb229e681c7581f433e9128b32e2c86c99596be1604d3cd2a3cc64d19dbe417d55441c7c71203babeffadf213a0bf7b715505d2976deef027584
-
Filesize
88KB
MD54e4ffd6981f1d7df1e06e02c7a52e86a
SHA1970d227a122a826f587fb49c694a422ec6aff1e0
SHA256353010e5cbdfb234aadfcb40b517b51b24bbac81b64d794d5d8f8b1cd0cd6031
SHA5121f75401fe015416453119bb92ea46c71412f342fe4bf1170bc2655a1c4f1fb4344bdff64df8dfd54f8203b30445225a70f12790432d3b59693e96de2fa5750ec
-
Filesize
230KB
MD58068d967a754039c953d677ed75caa65
SHA1c6ca62d0e3f84f4018546cdf40b14ac80b06af95
SHA256b2811334ba1ec945f7f2f1b1976e72dd634a4cf8b5679ceb4c90816d5b646b11
SHA5128f8f9b0c50f3178daa1df6ce16755c7a0de24872a344fe6b93d1a9b11cfad2faa1ed5ad58c6ac9904b889188d8efaba2d51e4240e7a813fffe6878ec8970954c