Analysis
-
max time kernel
106s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 03:50
Behavioral task
behavioral1
Sample
sigmasoft-0.1xw.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sigmasoft-0.1xw.exe
Resource
win10v2004-20240508-en
General
-
Target
sigmasoft-0.1xw.exe
-
Size
70KB
-
MD5
3df649fb09f96b8f230533fb47e278bd
-
SHA1
a23b90bef06801bb0a8741625b1d3442346b2c36
-
SHA256
6e0a8cf2d9273efa2593fe6f836013636da8fcc77c31fe00e05666fe9e41d124
-
SHA512
34cc7cece2c553086c191478302daa4fbb7b95dd0a176762b8a0400325bb965704d168df615713d9f23018f612e2aa0ab6b661ab052ed06ed5ac6b67dddbdb96
-
SSDEEP
1536:eX9lmdM9+Tuq1tndrW+btHA9g6xrOBjgUIdzPQUY:m9lQMOuet5W+btHARrOBFISV
Malware Config
Extracted
xworm
127.0.0.1:42772
never-knowledge.gl.at.ply.gg:42772
gorodpro-42772.portmap.host:42772
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-1-0x0000000000F70000-0x0000000000F88000-memory.dmp family_xworm C:\ProgramData\svchost.exe family_xworm behavioral1/memory/2368-37-0x0000000000F60000-0x0000000000F78000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1208 powershell.exe 2412 powershell.exe 2516 powershell.exe 2932 powershell.exe -
Drops startup file 2 IoCs
Processes:
sigmasoft-0.1xw.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk sigmasoft-0.1xw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk sigmasoft-0.1xw.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 2368 svchost.exe 2560 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sigmasoft-0.1xw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" sigmasoft-0.1xw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesigmasoft-0.1xw.exepid process 1208 powershell.exe 2412 powershell.exe 2516 powershell.exe 2932 powershell.exe 2252 sigmasoft-0.1xw.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
sigmasoft-0.1xw.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2252 sigmasoft-0.1xw.exe Token: SeDebugPrivilege 1208 powershell.exe Token: SeDebugPrivilege 2412 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 2252 sigmasoft-0.1xw.exe Token: SeDebugPrivilege 2368 svchost.exe Token: SeDebugPrivilege 2560 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
sigmasoft-0.1xw.exepid process 2252 sigmasoft-0.1xw.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
sigmasoft-0.1xw.exetaskeng.exedescription pid process target process PID 2252 wrote to memory of 1208 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 1208 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 1208 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2412 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2412 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2412 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2516 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2516 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2516 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2932 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2932 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 2932 2252 sigmasoft-0.1xw.exe powershell.exe PID 2252 wrote to memory of 860 2252 sigmasoft-0.1xw.exe schtasks.exe PID 2252 wrote to memory of 860 2252 sigmasoft-0.1xw.exe schtasks.exe PID 2252 wrote to memory of 860 2252 sigmasoft-0.1xw.exe schtasks.exe PID 1436 wrote to memory of 2368 1436 taskeng.exe svchost.exe PID 1436 wrote to memory of 2368 1436 taskeng.exe svchost.exe PID 1436 wrote to memory of 2368 1436 taskeng.exe svchost.exe PID 1436 wrote to memory of 2560 1436 taskeng.exe svchost.exe PID 1436 wrote to memory of 2560 1436 taskeng.exe svchost.exe PID 1436 wrote to memory of 2560 1436 taskeng.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmasoft-0.1xw.exe"C:\Users\Admin\AppData\Local\Temp\sigmasoft-0.1xw.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sigmasoft-0.1xw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sigmasoft-0.1xw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"2⤵
- Creates scheduled task(s)
PID:860
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7D9C2445-5445-4FE9-8188-F9CE41C1FA74} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD53df649fb09f96b8f230533fb47e278bd
SHA1a23b90bef06801bb0a8741625b1d3442346b2c36
SHA2566e0a8cf2d9273efa2593fe6f836013636da8fcc77c31fe00e05666fe9e41d124
SHA51234cc7cece2c553086c191478302daa4fbb7b95dd0a176762b8a0400325bb965704d168df615713d9f23018f612e2aa0ab6b661ab052ed06ed5ac6b67dddbdb96
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD525cfc7915c17d6ee5dd1f82643949219
SHA1c7830dd1398fe56fc86aadb6324a0d2bd19a4757
SHA2568c09e34f686daa12d32a0488c17d389292f2353c16de27fdb26095983dcd7b88
SHA5128c036ffe9806f38df3fba4fc434922c061134555f03c81935494921429d1b8af1a60aa7ab74b5ded9400fcaa128d322c0a9a64ae4daf717dfd276f5f1cc7262b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e