Malware Analysis Report

2024-11-16 13:33

Sample ID 240527-marwjsgb6x
Target caf.exe
SHA256 8150de8ca7edf3ba414fb09d1387c0751189969e5f9f69090593dc31d7d76c00
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8150de8ca7edf3ba414fb09d1387c0751189969e5f9f69090593dc31d7d76c00

Threat Level: Known bad

The file caf.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm family

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Drops startup file

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 10:16

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 10:16

Reported

2024-05-27 10:18

Platform

win7-20240419-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\caf.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys.lnk C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys.lnk C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Users\\Admin\\AppData\\Roaming\\sys.exe" C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\devmgmt.msc C:\Windows\system32\mmc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ED71BE1-1C12-11EF-AD38-76E827BE66E5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b556e9618dce77f1aee8716fd367313b8ef9dae02747be3fcaf77b73a0507ce6000000000e8000000002000020000000f4b31196fa3df9c7e36baef6183f85221eedc8e327e34986d3a8f9df4764684720000000ca829995309e856e2140b0873a0a0dc312579fa49a140b800ae9e31b10263b3340000000f95a53b73c36e4830942332bb145839ddac0b692cc9dfe38cde7b1155235a5abf32825f7597b9df23856b5e81d1f089dbefbd2265676d46d704cd6c7bc58cff3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000deb813c20a5d1030964390697fbe0d1e603f8e6bb9e221750901888fae9a178a000000000e8000000002000020000000d0abfc5dc642624df62dd867ba89409cf4ae4c23d5b4da633821d8c448816d9f900000003b93077d7461549e8b29565b194adea2c2f114d46cb4e078154cd9fe8164fd2246e641cdcac515f425f353b709b0f7b8a3380e0ce1a34a6ec2c1a3473d1fc423cbcc707dc73506f64384c9fba93b976b7e561637a60a64dd5d1d498bb34a061739fefbd87fefc5789513e4e88ff2f5e19ad65d72a0f56c6e82f36c4cc5fc564c07dec1056b6bbe26703ddda0587d9f544000000067d8fb62078c1aa22762427a02e59f8da5bb67d5aed3e4d4d769705c2766c0b7af6088bb9fa0617c54f3846033d12165ae1aaff5d7a9cd0645a72db9a445cc8f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c755231fb0da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2236 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\schtasks.exe
PID 2236 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\schtasks.exe
PID 2236 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\caf.exe C:\Windows\System32\schtasks.exe
PID 1652 wrote to memory of 292 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe
PID 1652 wrote to memory of 292 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe
PID 1652 wrote to memory of 292 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe
PID 1856 wrote to memory of 2324 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1856 wrote to memory of 2324 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1856 wrote to memory of 2324 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1856 wrote to memory of 2324 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1652 wrote to memory of 2796 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe
PID 1652 wrote to memory of 2796 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe
PID 1652 wrote to memory of 2796 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\sys.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\caf.exe

"C:\Users\Admin\AppData\Local\Temp\caf.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\caf.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'caf.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\sys.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sys.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sys" /tr "C:\Users\Admin\AppData\Roaming\sys.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\System32\control.exe

"C:\Windows\System32\control.exe" SYSTEM

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\system32\mmc.exe

"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc

C:\Windows\system32\taskeng.exe

taskeng.exe {0814B9E4-FA77-4686-BA73-E5DDDBF0FCA8} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SendUnlock.gif

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Users\Admin\AppData\Roaming\sys.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 sent-down.gl.at.ply.gg udp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp

Files

memory/2236-0-0x000007FEF60C3000-0x000007FEF60C4000-memory.dmp

memory/2236-1-0x0000000000B70000-0x0000000000B88000-memory.dmp

memory/2236-2-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

memory/2560-7-0x0000000002B90000-0x0000000002C10000-memory.dmp

memory/2560-8-0x000000001B680000-0x000000001B962000-memory.dmp

memory/2560-9-0x0000000002870000-0x0000000002878000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 8e72f8e144c029b794dd3aea1a494825
SHA1 1670c2d3278474972e5ae2d8eb1edbb9c4140b38
SHA256 99e1c0a960cb97c805199ede4037932f5dac0528a283313d208696a1c2762969
SHA512 15ced8adf1c2cba874ff071c7ca45d0f33e31c1b940a756346eb1b4b8928f9ff05b68c7c0516386558c2d54d464c79524199f1af822db788f4c267a682d52b0f

memory/2492-15-0x000000001B500000-0x000000001B7E2000-memory.dmp

memory/2492-16-0x00000000028F0000-0x00000000028F8000-memory.dmp

memory/2236-31-0x000007FEF60C3000-0x000007FEF60C4000-memory.dmp

memory/2236-32-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

memory/320-33-0x000007FEEE210000-0x000007FEEE24A000-memory.dmp

C:\Users\Admin\AppData\Roaming\sys.exe

MD5 791135ea6c451485f0ce1f2c84eb5604
SHA1 79825fba4b0835a362eb74b674870ddc6c898bac
SHA256 8150de8ca7edf3ba414fb09d1387c0751189969e5f9f69090593dc31d7d76c00
SHA512 f61cc6bb003013fb126cab60b9339027078fa55080ed085d8aadb980a3f0f12e0621bb64e79bd5126891fe3f66766932be0cbc4ebcefe58057ba78e3b3ce9bc6

memory/292-37-0x0000000000070000-0x0000000000088000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab47EB.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar483D.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e1c57e7aaaf7985f8db1b28059b5f28
SHA1 2a4915b00f479e8ab855d80af397f946b3c69a40
SHA256 43d64febed14c7a896d1c3160b43d2a9c25055f80fa79b3574da58a69b6e01cc
SHA512 fb2a45e90357cecf0e41ae46ebf168fbb4612dd5cb01e9d5dd7a7d924520a523673bb53cf25654a5067aff7390785977fa1f766aca207e09b0725dc79cc782cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 27b0e9217a20e385f92ddc15fe7c784e
SHA1 263e3f8b14925fdac3b7057991afd6645427be22
SHA256 26dfd1dc6ad9a8a12b0afc0e7348e8b5a07f32d96e0faa02a439dbc51c394544
SHA512 a8cccbaf1662d04e4e2491cbe33d566b55da5761264bb298a1b601be95eaa0d4e16bb2a9c4c0c7091cc99c3b2e24dd0285ab68d6173208ea77aa3a38b7c07ed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ead040c103a88e32dc0836aeb677c21
SHA1 7e038b634a31bf4802e2e758376215011f9bffe7
SHA256 903af68b5ca9b851643255f83646b013e5c230faa86e07124de18d0217a28cde
SHA512 35f4c01a2123327c37203f3e550277a636cce5d446ac6ed9b7255db9e555e8ebdce1ff5733e8830afe17879b966d82d95d1aa6804d3f4dc34fea60ac81e8facd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f1207de95c18ae648f3f0a80de5f3ff
SHA1 fd395f5df72d03bee7749faff3a129b566d1baea
SHA256 8bfbf452ff2f30b7914a8d6252613c55198e52eb270c5106dab3db5e614b0f18
SHA512 5f193b720f3e1203b822bd32940be001cbd5438b7a6f38b75d4549ea0c72b233f28a02238d4851baf03f79b6046a4ed56f9e4715fefb85baf56a7ded607e4db7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8744714de98cef147f8e23f275cc5155
SHA1 32dc49040528cf815ffc0731bd046dc865939b6b
SHA256 c9837d32855acf497e086a457b7546531675a01aeb032eb8ce9336b76a912e6b
SHA512 d804814ed23118b9b00b74852c82cd34b9801348548b042c3aba3129e098ff8d6868b4f972e10bbb723d57ee3383a6a93f66fb1bf611c1203576ad885e259bcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1067a6bc60794118b8471a0062bb6e0
SHA1 237357f4a1f91fea3acd093b508e47fe01431b0b
SHA256 75613f86953c28983de14fffd6ec1ff56cf4a16560195013fcddef1cd502f95d
SHA512 e3d6d391e266de7d279fae587214e0b76fd68e15935e23a39262d0810a4e2a445d09ccbfa0e5132e7cbbec85cc279834c12b92e3eedd276e07dc2198b1986978

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db39ad5c3ea305dbb925a8cadce87cab
SHA1 f31ad1c78768f392808f86f55a3927cde207cf4e
SHA256 efa68f7397056699eccbce88920c64c98376e4dc1627ed8df2b6711dd1ea2b45
SHA512 54a1309cdbf42280d162809f68d1eae27c511e163adf6c2c17f5d057b518d94cbc122b257359af47086f4ff52fffc67d36955f765fb62b3e0f283f727152db35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c5f2a123214dcc4f7ab519be55cc5e5
SHA1 5afecc3e2f2a26033a4c9ced5db8f6c565ad1a8c
SHA256 8f1e43f4095a51ba786396ba6a81265283e46cacd5fe364cfa24535f38095a5c
SHA512 5756912d755e37d51a97d5fcc7bb4b72e89eb8803568ccaffcdeb060fac4ac11d2dd70fcaaf3a0ae07bbe59379fd707c5e3d2e31f739b2a68839fdbaa6b96c76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c8eeaa65d6726641b95dae29b59b8f5
SHA1 f4af11203d48035bb5e58f479a4b2331a7917b5b
SHA256 a2f89a2a40e79b3f8e9194ade6625323b3f19b2d4b3586f51dc135c8bc25bcd5
SHA512 8e737e6e81e84e83c1b692853e1019ef06f95088de3b69b46a64fbf2b01be18e89a0c879fc2accc142d611bfe115fcb21599f9c32f4e83b6ba2ec2469ba37c6d

C:\Users\Admin\AppData\Local\Temp\~DFCEF07526F89A1D75.TMP

MD5 12ad44d3af07578a3227dc5c7e41633b
SHA1 7c0ce3352fa6802707ef54723a400df53eef7cdc
SHA256 35c6b3b92910c8e731b835e73e46e10ca37168731b171d88107adcba8231bb8c
SHA512 2e3f4e0eb46253f6a542793431616b64260616c2aa9c5cf76a8b25b77193113c971bda34e75372bc87f630832c044df98dc97ee524357ad7c5930fd14818955b

memory/2796-481-0x0000000001180000-0x0000000001198000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 10:16

Reported

2024-05-27 10:18

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\caf.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys.lnk C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys.lnk C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Users\\Admin\\AppData\\Roaming\\sys.exe" C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sys.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\caf.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\caf.exe

"C:\Users\Admin\AppData\Local\Temp\caf.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\caf.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'caf.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\sys.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sys.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sys" /tr "C:\Users\Admin\AppData\Roaming\sys.exe"

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Users\Admin\AppData\Roaming\sys.exe

C:\Users\Admin\AppData\Roaming\sys.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 168.61.62.23.in-addr.arpa udp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 sent-down.gl.at.ply.gg udp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp
US 147.185.221.16:2905 sent-down.gl.at.ply.gg tcp

Files

memory/2760-1-0x00000000000C0000-0x00000000000D8000-memory.dmp

memory/2760-0-0x00007FF99AA53000-0x00007FF99AA55000-memory.dmp

memory/2760-2-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

memory/4236-3-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

memory/4236-4-0x0000028C735C0000-0x0000028C735E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjqs0t0t.cd3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4236-5-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

memory/4236-15-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

memory/4236-18-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 672702f55e79800155f81b200ae32c11
SHA1 dfaaf4ad96e5d49d9f0cd36de2fe59cdda0e4a70
SHA256 69efe7d499bed2ebe41ecbf1d51fc326e191e0108bfc53f4f5700175e4588179
SHA512 b488290bf641d99120db2521489322b1e5552ba4868c732c6949105e5eef0902711ef896af4641075f6b66b4dcabc7bf8942ecf1d077e21b4cf005df73522368

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e3161f4edbc9b963debe22e29658050b
SHA1 45dbf88dadafe5dd1cfee1e987c8a219d3208cdb
SHA256 1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a
SHA512 006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

memory/2760-57-0x00007FF99AA53000-0x00007FF99AA55000-memory.dmp

memory/2760-58-0x00007FF99AA50000-0x00007FF99B511000-memory.dmp

C:\Users\Admin\AppData\Roaming\sys.exe

MD5 791135ea6c451485f0ce1f2c84eb5604
SHA1 79825fba4b0835a362eb74b674870ddc6c898bac
SHA256 8150de8ca7edf3ba414fb09d1387c0751189969e5f9f69090593dc31d7d76c00
SHA512 f61cc6bb003013fb126cab60b9339027078fa55080ed085d8aadb980a3f0f12e0621bb64e79bd5126891fe3f66766932be0cbc4ebcefe58057ba78e3b3ce9bc6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sys.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1