Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 11:47
Behavioral task
behavioral1
Sample
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe
Resource
win10v2004-20240508-en
General
-
Target
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe
-
Size
150KB
-
MD5
d5c26e12be6264033efd9e5e0662a953
-
SHA1
e4570cecc53e5e916c06e38c62221f27af7a1225
-
SHA256
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b
-
SHA512
adbb48ebda59c9b804ddaf4561a0679436987d6deef883d632f0eeb30adbc9c812f09eeefbbaef013f3139a5b6e3665af276a283c5ef73031861b49d01136b55
-
SSDEEP
3072:Ahd295oBFr9DnO/nk4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvM:AaLonr9jgVqwlL
Malware Config
Extracted
xworm
5.0
p-never.gl.at.ply.gg:57388
EKx5toUcZoEkFlZt
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-1-0x00000000012F0000-0x000000000131C000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\svchost.exe family_xworm behavioral1/memory/836-37-0x00000000003B0000-0x00000000003DC000-memory.dmp family_xworm behavioral1/memory/1664-40-0x00000000010D0000-0x00000000010FC000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2516 powershell.exe 2688 powershell.exe 2416 powershell.exe 2648 powershell.exe -
Drops startup file 2 IoCs
Processes:
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 836 svchost.exe 1664 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2648 powershell.exe 2516 powershell.exe 2688 powershell.exe 2416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe Token: SeDebugPrivilege 2648 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2416 powershell.exe Token: SeDebugPrivilege 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe Token: SeDebugPrivilege 836 svchost.exe Token: SeDebugPrivilege 1664 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exetaskeng.exedescription pid process target process PID 1740 wrote to memory of 2648 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2648 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2648 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2516 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2516 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2516 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2688 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2688 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2688 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2416 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2416 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 2416 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe powershell.exe PID 1740 wrote to memory of 1476 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe schtasks.exe PID 1740 wrote to memory of 1476 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe schtasks.exe PID 1740 wrote to memory of 1476 1740 28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe schtasks.exe PID 1244 wrote to memory of 836 1244 taskeng.exe svchost.exe PID 1244 wrote to memory of 836 1244 taskeng.exe svchost.exe PID 1244 wrote to memory of 836 1244 taskeng.exe svchost.exe PID 1244 wrote to memory of 1664 1244 taskeng.exe svchost.exe PID 1244 wrote to memory of 1664 1244 taskeng.exe svchost.exe PID 1244 wrote to memory of 1664 1244 taskeng.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe"C:\Users\Admin\AppData\Local\Temp\28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '28c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {A360F814-F690-432C-90E8-C888799D602D} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5db2560e5d1c6ee6027cb00718b675e02
SHA134ee3c78d41dda494077b6611109a4ec12513dd6
SHA256993cf5b3aac7f2f94c00ec986f65c36a5c6b1fc65c1ce56e61fa9012715b3deb
SHA51209ad2c5f0cb04faed17e0effaf1dfb0725901a7476e8fb19fce5444bdfee54d76c971397c69545c52c098c8a82b98584af152f46445f26013eaa3696d72a62ea
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
150KB
MD5d5c26e12be6264033efd9e5e0662a953
SHA1e4570cecc53e5e916c06e38c62221f27af7a1225
SHA25628c951715ea1f1e20db6e2694c8b9676837190d4ff1c49c6c9f7cb41b899a91b
SHA512adbb48ebda59c9b804ddaf4561a0679436987d6deef883d632f0eeb30adbc9c812f09eeefbbaef013f3139a5b6e3665af276a283c5ef73031861b49d01136b55
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/836-37-0x00000000003B0000-0x00000000003DC000-memory.dmpFilesize
176KB
-
memory/1664-40-0x00000000010D0000-0x00000000010FC000-memory.dmpFilesize
176KB
-
memory/1740-32-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmpFilesize
4KB
-
memory/1740-1-0x00000000012F0000-0x000000000131C000-memory.dmpFilesize
176KB
-
memory/1740-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmpFilesize
4KB
-
memory/1740-33-0x000000001B1F0000-0x000000001B270000-memory.dmpFilesize
512KB
-
memory/1740-31-0x000000001B1F0000-0x000000001B270000-memory.dmpFilesize
512KB
-
memory/2516-14-0x000000001B650000-0x000000001B932000-memory.dmpFilesize
2.9MB
-
memory/2516-15-0x0000000002250000-0x0000000002258000-memory.dmpFilesize
32KB
-
memory/2648-8-0x0000000002720000-0x0000000002728000-memory.dmpFilesize
32KB
-
memory/2648-7-0x000000001B500000-0x000000001B7E2000-memory.dmpFilesize
2.9MB
-
memory/2648-6-0x0000000002A20000-0x0000000002AA0000-memory.dmpFilesize
512KB