Analysis

  • max time kernel
    1798s
  • max time network
    1806s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-05-2024 14:19

General

  • Target

    проверка.exe

  • Size

    102KB

  • MD5

    58174445e23753c941d39dc0453ac348

  • SHA1

    40e3a9047c49cbae6818297adcd03896d28364c2

  • SHA256

    1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

  • SHA512

    523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

  • SSDEEP

    1536:oBFpc8Z5dGYzabvawh+/C6vSX/QOcy/WPPqUs/uoDjSBSc7UtYVL:oa85dGCabvaw4/moOcy/R/1W0cgteL

Malware Config

Extracted

Family

xworm

C2

19.ip.gl.ply.gg:65468

speed-wheat.gl.at.ply.gg:65468

XWorm V5.2:123

Attributes
  • Install_directory

    %AppData%

  • install_file

    Delta.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 30 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\проверка.exe
    "C:\Users\Admin\AppData\Local\Temp\проверка.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4564
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2944
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4512
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:3776
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1008
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1752
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1344
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3500
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:892
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3284
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1608
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3436
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4616
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4348
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3168
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2936
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3352
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1312
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3436
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:744
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3132
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:240
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:248
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2016
    • C:\Users\Admin\AppData\Roaming\Delta.exe
      C:\Users\Admin\AppData\Roaming\Delta.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2452

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Delta.exe.log

      Filesize

      654B

      MD5

      2cbbb74b7da1f720b48ed31085cbd5b8

      SHA1

      79caa9a3ea8abe1b9c4326c3633da64a5f724964

      SHA256

      e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

      SHA512

      ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      5ba388a6597d5e09191c2c88d2fdf598

      SHA1

      13516f8ec5a99298f6952438055c39330feae5d8

      SHA256

      e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca

      SHA512

      ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      687b3558d687becb30ad8f90997723cc

      SHA1

      fb326d7d105aba4d26e1764e73fd124cad23f298

      SHA256

      5283507c63132fdaf5d64bb0a09bcd6ae6d412a4df0be934268bf8e774207ece

      SHA512

      f827d61fad06764cefbca1688b8b2df7c07a1080be42f524de9765650382db84151ee90dd74b6568ea6f5bc582399695ec2c1c598256076f2dc91ff250450abd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e07eea85a8893f23fb814cf4b3ed974c

      SHA1

      8a8125b2890bbddbfc3531d0ee4393dbbf5936fe

      SHA256

      83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea

      SHA512

      9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      64497dba662bee5d7ae7a3c76a72ed88

      SHA1

      edc027042b9983f13d074ba9eed8b78e55e4152e

      SHA256

      ca69ebbd2c9c185f0647fb2122d7a26e7d23af06a1950fb25ac327d869687b47

      SHA512

      25da69ec86ba0df6c7da60f722cc2919c59c91f2bb03137e0e87771936e5271522d48eef98030a0da41f7a707d82221d35fb016f8bb9a294e87be114adbe3522

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gcbjo5um.a0z.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Delta.exe

      Filesize

      102KB

      MD5

      58174445e23753c941d39dc0453ac348

      SHA1

      40e3a9047c49cbae6818297adcd03896d28364c2

      SHA256

      1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

      SHA512

      523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

    • memory/3096-1-0x0000000000970000-0x0000000000990000-memory.dmp

      Filesize

      128KB

    • memory/3096-0-0x00007FFA51183000-0x00007FFA51185000-memory.dmp

      Filesize

      8KB

    • memory/3096-55-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/3096-54-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-11-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-18-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-15-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-14-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-13-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-12-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-10-0x0000014BE37D0000-0x0000014BE37F2000-memory.dmp

      Filesize

      136KB