Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 21:28
Behavioral task
behavioral1
Sample
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe
Resource
win10v2004-20240508-en
General
-
Target
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe
-
Size
75KB
-
MD5
2fdfdc28bc8f362cc5f8c011d42d0a1e
-
SHA1
67d6b431dfa75f02219dbee35c72f8d3636e21da
-
SHA256
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500
-
SHA512
2694c1e44285d9e8d98e1b3762a6d83b27e4eaa0a5b71441e920154904aadde4b6d831c16ad573b2d978b57859c06d37f1eb8cdf48a4427489f04141c6bffb82
-
SSDEEP
1536:rgc6J73fHqXWZ16J452BapyWhabisdvojWVQ8GNQ9t6kut3Ov9K97B:rgr7PlnyWobisslquxOFKVB
Malware Config
Extracted
xworm
rent-pas.gl.at.ply.gg:25215
-
Install_directory
%Temp%
-
install_file
NvidiaPanel.exe
Signatures
-
Detect Xworm Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-1-0x0000000000B90000-0x0000000000BAA000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe family_xworm behavioral1/memory/1016-36-0x00000000003B0000-0x00000000003CA000-memory.dmp family_xworm behavioral1/memory/1060-40-0x0000000000A80000-0x0000000000A9A000-memory.dmp family_xworm behavioral1/memory/780-42-0x0000000001370000-0x000000000138A000-memory.dmp family_xworm -
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-1-0x0000000000B90000-0x0000000000BAA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1016-36-0x00000000003B0000-0x00000000003CA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1060-40-0x0000000000A80000-0x0000000000A9A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/780-42-0x0000000001370000-0x000000000138A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2868 powershell.exe 2528 powershell.exe 1516 powershell.exe 2532 powershell.exe -
Drops startup file 2 IoCs
Processes:
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaPanel.lnk 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaPanel.lnk 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe -
Executes dropped EXE 3 IoCs
Processes:
NvidiaPanel.exeNvidiaPanel.exeNvidiaPanel.exepid process 1016 NvidiaPanel.exe 1060 NvidiaPanel.exe 780 NvidiaPanel.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaPanel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NvidiaPanel.exe" 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exe4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exepid process 2532 powershell.exe 2868 powershell.exe 2528 powershell.exe 1516 powershell.exe 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exepowershell.exepowershell.exepowershell.exepowershell.exeNvidiaPanel.exeNvidiaPanel.exeNvidiaPanel.exedescription pid process Token: SeDebugPrivilege 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe Token: SeDebugPrivilege 1016 NvidiaPanel.exe Token: SeDebugPrivilege 1060 NvidiaPanel.exe Token: SeDebugPrivilege 780 NvidiaPanel.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exepid process 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exetaskeng.exedescription pid process target process PID 1964 wrote to memory of 2532 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2532 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2532 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2868 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2868 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2868 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2528 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2528 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2528 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 1516 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 1516 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 1516 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe powershell.exe PID 1964 wrote to memory of 2640 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe schtasks.exe PID 1964 wrote to memory of 2640 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe schtasks.exe PID 1964 wrote to memory of 2640 1964 4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe schtasks.exe PID 1464 wrote to memory of 1016 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 1016 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 1016 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 1060 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 1060 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 1060 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 780 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 780 1464 taskeng.exe NvidiaPanel.exe PID 1464 wrote to memory of 780 1464 taskeng.exe NvidiaPanel.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe"C:\Users\Admin\AppData\Local\Temp\4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NvidiaPanel.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NvidiaPanel" /tr "C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe"2⤵
- Creates scheduled task(s)
PID:2640
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F5C0C3F4-DA9F-402A-854D-2F98EC8B3FBF} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exeC:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exeC:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exeC:\Users\Admin\AppData\Local\Temp\NvidiaPanel.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD52fdfdc28bc8f362cc5f8c011d42d0a1e
SHA167d6b431dfa75f02219dbee35c72f8d3636e21da
SHA2564a29205d5c7853d089ed8faebc6d412f0c58f782eba05d70b2a2cfc7ee3e2500
SHA5122694c1e44285d9e8d98e1b3762a6d83b27e4eaa0a5b71441e920154904aadde4b6d831c16ad573b2d978b57859c06d37f1eb8cdf48a4427489f04141c6bffb82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD517feeb28459a274e901c2fb5ff7660b7
SHA1f1662e0d4a3a646adcd38156fe5edf1d10295be7
SHA2569dba91122170b76e2b27c9e7e6b3006c52e64cd91f93e666a1cb31a2d79c5d6f
SHA5126164677c359de8a44ec23d5d436eacb62db4022528b3c788215fff25d9cbec892fc18d52b397237eb5f1a9f0cdb30692fbcbe5eb633d373f55958d439941aa14
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e