Analysis Overview
SHA256
82702da0dadc378e1995679ed5cab6ae3d3c3e189ca7f3401c9b047e53b4648f
Threat Level: Known bad
The file svchost.exe was found to be: Known bad.
Malicious Activity Summary
Xworm
Detect Xworm Payload
Command and Scripting Interpreter: PowerShell
Drops startup file
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Windows directory
Enumerates physical storage devices
Unsigned PE
Suspicious use of FindShellTrayWindow
Suspicious behavior: GetForegroundWindowSpam
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-31 22:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-31 22:35
Reported
2024-05-31 22:37
Platform
win10-20240404-en
Max time kernel
98s
Max time network
100s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | 0.tcp.eu.ngrok.io | N/A | N/A |
| N/A | 0.tcp.eu.ngrok.io | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rescache\_merged\1601268389\715946058.pri | C:\Windows\system32\taskmgr.exe | N/A |
| File created | C:\Windows\rescache\_merged\4183903823\2290032291.pri | C:\Windows\system32\taskmgr.exe | N/A |
| File created | C:\Windows\rescache\_merged\2717123927\1590785016.pri | C:\Windows\system32\taskmgr.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 235.3.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.tcp.eu.ngrok.io | udp |
| DE | 3.125.102.39:10911 | 0.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 39.102.125.3.in-addr.arpa | udp |
| DE | 3.125.102.39:10911 | 0.tcp.eu.ngrok.io | tcp |
| DE | 3.125.102.39:10911 | 0.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 0.tcp.eu.ngrok.io | udp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 75.249.158.18.in-addr.arpa | udp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
| DE | 18.158.249.75:10911 | 0.tcp.eu.ngrok.io | tcp |
Files
memory/5064-0-0x0000000000B40000-0x0000000000EBC000-memory.dmp
memory/5064-1-0x0000000073B4E000-0x0000000073B4F000-memory.dmp
memory/5064-2-0x0000000000B40000-0x0000000000EBC000-memory.dmp
memory/5064-3-0x00000000061A0000-0x000000000623C000-memory.dmp
memory/5064-4-0x0000000006100000-0x0000000006166000-memory.dmp
memory/5064-5-0x0000000073B40000-0x000000007422E000-memory.dmp
memory/5068-9-0x0000000073B40000-0x000000007422E000-memory.dmp
memory/5068-8-0x0000000000EC0000-0x0000000000EF6000-memory.dmp
memory/5068-10-0x0000000007030000-0x0000000007658000-memory.dmp
memory/5068-11-0x0000000073B40000-0x000000007422E000-memory.dmp
memory/5068-12-0x0000000006C90000-0x0000000006CB2000-memory.dmp
memory/5068-13-0x0000000006F30000-0x0000000006F96000-memory.dmp
memory/5068-14-0x0000000007740000-0x0000000007A90000-memory.dmp
memory/5068-15-0x00000000076C0000-0x00000000076DC000-memory.dmp
memory/5068-16-0x0000000007D00000-0x0000000007D4B000-memory.dmp
memory/5068-17-0x0000000007E30000-0x0000000007EA6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tf2ff3tj.p0o.ps1
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| SHA512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
memory/5068-34-0x0000000008F30000-0x0000000008F63000-memory.dmp
memory/5068-35-0x000000006F520000-0x000000006F56B000-memory.dmp
memory/5068-36-0x0000000073B40000-0x000000007422E000-memory.dmp
memory/5068-37-0x0000000008EF0000-0x0000000008F0E000-memory.dmp
memory/5068-42-0x0000000009060000-0x0000000009105000-memory.dmp
memory/5068-43-0x0000000073B40000-0x000000007422E000-memory.dmp
memory/5068-44-0x0000000009230000-0x00000000092C4000-memory.dmp
memory/5068-237-0x00000000091D0000-0x00000000091EA000-memory.dmp
memory/5068-242-0x00000000091C0000-0x00000000091C8000-memory.dmp
memory/5068-258-0x0000000073B40000-0x000000007422E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 1c19c16e21c97ed42d5beabc93391fc5 |
| SHA1 | 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68 |
| SHA256 | 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05 |
| SHA512 | 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 57c4e5d32dcc5f4169a0b2f7d426c2e5 |
| SHA1 | 726c10d19c9017f0d89091a4649167580c59d5f2 |
| SHA256 | 87662d745b8cdd2b3fc5d7f0cd134ffcb335fed39d641123677ee61491be3371 |
| SHA512 | 6940686c3b256592637af075364f32fb0a85bd6ae76038cd3e1de6b4684c22f6a5a9eabe3190432865f0be0f8adb5fbfba53e42a28a1fa93591ef12dad7f7862 |
memory/2160-279-0x000000006F520000-0x000000006F56B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d06d36a6aefa4b117ae6e542ac8a8a20 |
| SHA1 | 1480979a6d340d32fa4dac00f08496f67839db9d |
| SHA256 | 349f320feb41912e17d5902135d826ff86881241e63a81368c2948f4effae414 |
| SHA512 | 010472e109bc04b0e86e9dc038155f788256b9eb6dea86deef81ffab827e7fed76cad72d881cfb572bcd349d3ad87518b9e2afd7d3ca78a79f6aec89ed7d0077 |
memory/1936-513-0x000000006F520000-0x000000006F56B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 80012a08010628138885b89fdbe83b92 |
| SHA1 | bfb1bb4b1155d29b3b30163f57011c8f54c7610f |
| SHA256 | d858f902513f139c4ec3276205f6f4d1aec249cacf0425cc024df0c200636e88 |
| SHA512 | 58bbd3f93133df2de67e5a71aa5857295f0df8f63566c950d6bdb6fd94da59b61385572aac8af420f26dcc8910b5e626bbbc9e680adbcbe91abcf6578b03be4b |
memory/1900-747-0x000000006F520000-0x000000006F56B000-memory.dmp
memory/5064-967-0x0000000000B40000-0x0000000000EBC000-memory.dmp
memory/5064-968-0x0000000073B4E000-0x0000000073B4F000-memory.dmp
memory/5064-970-0x0000000073B40000-0x000000007422E000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
| MD5 | 7877b7e2580911b4cfcb3475cebaa4d7 |
| SHA1 | dab254bde67478854cfa313799c79a5d025ade42 |
| SHA256 | ce8dd4df07319de0295e1d3703711719c4c6300702a207d2eb3a57486df9894e |
| SHA512 | dc52b94a7c8924fc3f0e7de2fc88d2a55ad1c871750986d780233966a0f85002e92b1c2dc1178340c364aae997c16d38e52f12f04d2509e8eb1ef8b87987cd15 |
C:\Users\Admin\AppData\Roaming\svchost.exe
| MD5 | 0bb46f1aa0f9ec8b6ce4a718a6ffe8a4 |
| SHA1 | 621449aa1d94f91b30ff7984a7457d6aed2d0075 |
| SHA256 | 82702da0dadc378e1995679ed5cab6ae3d3c3e189ca7f3401c9b047e53b4648f |
| SHA512 | 5cd89e242d980aedc9fb0f0eb28b0202a6a6c5db6c1146d8d7ecebc72235982d9585086e4c9f62c9b0af8d7082c72b7397de468280050da0b438bd6ebbd5d443 |