Analysis
-
max time kernel
325s -
max time network
273s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 08:22
Static task
static1
Behavioral task
behavioral1
Sample
WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win11-20240508-en
Errors
General
-
Target
WinXP.Horror.Destructive (Created By WobbyChip).exe
-
Size
57.9MB
-
MD5
063ea883f8c67d3bb22e0a465136ca4c
-
SHA1
3a168a9153ee32b86d9a5411b0af13846c55ee1d
-
SHA256
3b64ce283febf3207dd20c99fc53de65b07044231eb544c4c41de374a2571c5c
-
SHA512
2dd6be23a5af8c458b94eeb5a4e83fc8cacb3fd2c2566b5682eee286c01726dca90db3d9b4e218eeded9b0c9bce8ba3c9ca9cc497e3a57aab580633a038e4b74
-
SSDEEP
1572864:aj6L5PLk/mBCSyKOYl39GFoFEujFMm+B997DaNHN1oS72fnD9hRzZ01tO0DpvrvI:i6cSzV9GCFEujFMm+B997DaNHN1oS72X
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables Task Manager via registry modification
-
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process File opened for modification \??\PhysicalDrive0 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Modifies Control Panel 2 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\Mouse WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\Mouse\SwapMouseButtons = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exepid process 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AUDIODG.EXEWinXP.Horror.Destructive (Created By WobbyChip).exedescription pid process Token: 33 1864 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1864 AUDIODG.EXE Token: SeDebugPrivilege 1772 WinXP.Horror.Destructive (Created By WobbyChip).exe -
System policy modification 1 TTPs 5 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer WinXP.Horror.Destructive (Created By WobbyChip).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinXP.Horror.Destructive (Created By WobbyChip).exe"C:\Users\Admin\AppData\Local\Temp\WinXP.Horror.Destructive (Created By WobbyChip).exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004BC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1772-0-0x0000000003FD0000-0x0000000003FD1000-memory.dmpFilesize
4KB
-
memory/1772-1-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-2-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-3-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-4-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-5-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-6-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-9-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-10-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-11-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-12-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-13-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-14-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-15-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-16-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-17-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-18-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-19-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-20-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-21-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-22-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-23-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-24-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-25-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-27-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-28-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-31-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-32-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-33-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1772-34-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB