Analysis
-
max time kernel
147s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 15:28
Behavioral task
behavioral1
Sample
Expensive 3.0.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Expensive 3.0.exe
Resource
win10v2004-20240508-en
General
-
Target
Expensive 3.0.exe
-
Size
71KB
-
MD5
4d8c67f116afed39d1a1638d1f60e82c
-
SHA1
f7bde1231a237cd5bb663c729bee92bbdf20e46d
-
SHA256
adba1f5dfc1e917467184dcc01cd67fe3e5dfafa5db03c52b4bb7894827fad79
-
SHA512
9cc32e1dbe32d6f45f0c25782f55e0a62eb0cc78d426834cec9a91f209d2cc72fa7e1dc0995339a227b0f6124ac84602272aa1d71d0dfb6eea11328fe6415364
-
SSDEEP
1536:FscQuSvo0znd8gyFRN2ibLC+bxGuTMcpoz6G4OufqN:FoPtzn+PNDbLC+bxGuTSF4Oufu
Malware Config
Extracted
xworm
loss-winners.gl.at.ply.gg:61007:1567
-
Install_directory
%AppData%
-
install_file
Expensive 3.1.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1072-1-0x0000000000D00000-0x0000000000D18000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 548 powershell.exe 2908 powershell.exe 4012 powershell.exe 3296 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Expensive 3.0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Expensive 3.0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Expensive 3.0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Expensive 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Expensive 3.1.exe" Expensive 3.0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeExpensive 3.0.exepid process 2908 powershell.exe 2908 powershell.exe 4012 powershell.exe 4012 powershell.exe 3296 powershell.exe 3296 powershell.exe 548 powershell.exe 548 powershell.exe 1072 Expensive 3.0.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Expensive 3.0.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1072 Expensive 3.0.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 3296 powershell.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeDebugPrivilege 1072 Expensive 3.0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Expensive 3.0.exepid process 1072 Expensive 3.0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Expensive 3.0.exedescription pid process target process PID 1072 wrote to memory of 2908 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 2908 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 4012 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 4012 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 3296 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 3296 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 548 1072 Expensive 3.0.exe powershell.exe PID 1072 wrote to memory of 548 1072 Expensive 3.0.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Expensive 3.0.exe"C:\Users\Admin\AppData\Local\Temp\Expensive 3.0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Expensive 3.0.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.0.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5ef72c47dbfaae0b9b0d09f22ad4afe20
SHA15357f66ba69b89440b99d4273b74221670129338
SHA256692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
SHA5127514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4
-
Filesize
944B
MD5e58749a7a1826f6ea62df1e2ef63a32b
SHA1c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA2560e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
SHA5124cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82