Analysis
-
max time kernel
164s -
max time network
200s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
31-05-2024 09:00
Behavioral task
behavioral1
Sample
проверка.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
проверка.exe
Resource
win10-20240404-en
General
-
Target
проверка.exe
-
Size
102KB
-
MD5
58174445e23753c941d39dc0453ac348
-
SHA1
40e3a9047c49cbae6818297adcd03896d28364c2
-
SHA256
1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171
-
SHA512
523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072
-
SSDEEP
1536:oBFpc8Z5dGYzabvawh+/C6vSX/QOcy/WPPqUs/uoDjSBSc7UtYVL:oa85dGCabvaw4/moOcy/R/1W0cgteL
Malware Config
Extracted
xworm
19.ip.gl.ply.gg:65468
speed-wheat.gl.at.ply.gg:65468
XWorm V5.2:123
-
Install_directory
%AppData%
-
install_file
Delta.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4460-1-0x00000000005F0000-0x0000000000610000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\Delta.exe family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4244 powershell.exe 4428 powershell.exe 4616 powershell.exe 2200 powershell.exe -
Drops startup file 2 IoCs
Processes:
проверка.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Delta.lnk проверка.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Delta.lnk проверка.exe -
Executes dropped EXE 2 IoCs
Processes:
Delta.exeDelta.exepid process 3396 Delta.exe 2456 Delta.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
проверка.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\Delta = "C:\\Users\\Admin\\AppData\\Roaming\\Delta.exe" проверка.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exetaskmgr.exepowershell.exepowershell.exeпроверка.exepid process 4428 powershell.exe 4428 powershell.exe 4428 powershell.exe 4616 powershell.exe 4616 powershell.exe 1680 taskmgr.exe 1680 taskmgr.exe 4616 powershell.exe 1680 taskmgr.exe 1680 taskmgr.exe 2200 powershell.exe 2200 powershell.exe 2200 powershell.exe 1680 taskmgr.exe 1680 taskmgr.exe 4244 powershell.exe 4244 powershell.exe 4244 powershell.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 4460 проверка.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1680 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
проверка.exepowershell.exepowershell.exetaskmgr.exepowershell.exedescription pid process Token: SeDebugPrivilege 4460 проверка.exe Token: SeDebugPrivilege 4428 powershell.exe Token: SeIncreaseQuotaPrivilege 4428 powershell.exe Token: SeSecurityPrivilege 4428 powershell.exe Token: SeTakeOwnershipPrivilege 4428 powershell.exe Token: SeLoadDriverPrivilege 4428 powershell.exe Token: SeSystemProfilePrivilege 4428 powershell.exe Token: SeSystemtimePrivilege 4428 powershell.exe Token: SeProfSingleProcessPrivilege 4428 powershell.exe Token: SeIncBasePriorityPrivilege 4428 powershell.exe Token: SeCreatePagefilePrivilege 4428 powershell.exe Token: SeBackupPrivilege 4428 powershell.exe Token: SeRestorePrivilege 4428 powershell.exe Token: SeShutdownPrivilege 4428 powershell.exe Token: SeDebugPrivilege 4428 powershell.exe Token: SeSystemEnvironmentPrivilege 4428 powershell.exe Token: SeRemoteShutdownPrivilege 4428 powershell.exe Token: SeUndockPrivilege 4428 powershell.exe Token: SeManageVolumePrivilege 4428 powershell.exe Token: 33 4428 powershell.exe Token: 34 4428 powershell.exe Token: 35 4428 powershell.exe Token: 36 4428 powershell.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 1680 taskmgr.exe Token: SeSystemProfilePrivilege 1680 taskmgr.exe Token: SeCreateGlobalPrivilege 1680 taskmgr.exe Token: SeIncreaseQuotaPrivilege 4616 powershell.exe Token: SeSecurityPrivilege 4616 powershell.exe Token: SeTakeOwnershipPrivilege 4616 powershell.exe Token: SeLoadDriverPrivilege 4616 powershell.exe Token: SeSystemProfilePrivilege 4616 powershell.exe Token: SeSystemtimePrivilege 4616 powershell.exe Token: SeProfSingleProcessPrivilege 4616 powershell.exe Token: SeIncBasePriorityPrivilege 4616 powershell.exe Token: SeCreatePagefilePrivilege 4616 powershell.exe Token: SeBackupPrivilege 4616 powershell.exe Token: SeRestorePrivilege 4616 powershell.exe Token: SeShutdownPrivilege 4616 powershell.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeSystemEnvironmentPrivilege 4616 powershell.exe Token: SeRemoteShutdownPrivilege 4616 powershell.exe Token: SeUndockPrivilege 4616 powershell.exe Token: SeManageVolumePrivilege 4616 powershell.exe Token: 33 4616 powershell.exe Token: 34 4616 powershell.exe Token: 35 4616 powershell.exe Token: 36 4616 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe 1680 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
проверка.exepid process 4460 проверка.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
проверка.exedescription pid process target process PID 4460 wrote to memory of 4428 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 4428 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 4616 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 4616 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 2200 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 2200 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 4244 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 4244 4460 проверка.exe powershell.exe PID 4460 wrote to memory of 1304 4460 проверка.exe schtasks.exe PID 4460 wrote to memory of 1304 4460 проверка.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\проверка.exe"C:\Users\Admin\AppData\Local\Temp\проверка.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"2⤵
- Creates scheduled task(s)
PID:1304
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1680
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
PID:3396
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
PID:2456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
1KB
MD59e96a46c252a414a503bc7bec8d268ee
SHA141e23367c4109d4e657593e19f12f147e5815c0c
SHA25652deea3f86609b31108f4e4519cd5c5019918407eff3bf437118e1f6993158d5
SHA51287df7e9cd60354904a762f1df7ac8162cfcae456288703d943d65bef9e0cbfa8b7fdfcff1facf252268b063d004bf3a80d5d7512dda9d362ee7be7b6d2358068
-
Filesize
1KB
MD513d801f8c5fcbb59a71d544b74f47bc3
SHA1d6998e4c774a5ad98045abca3c4f31485e5c5ae2
SHA256b3ad2c8e2aff2a1ad41ae434d4912b48fb8a3a5514d9f080d95bb68db18e402c
SHA512a76f7a61fe572a2343fd4127b33bbf93cc9c4c5394a82a9cc0dab04090351318c3e1df87e14cd190846ff35c7161084c473a5091da1727993ffc21df67fb14f2
-
Filesize
1KB
MD5863b33d71f0ac94388c541e5b1a1f04c
SHA1f75d024a7ab5c150c4ae0b41543606e1752df962
SHA2560bf5d47a16ed2e8a7b8121e77484d29d969ca8f450d8756eaba1c738788e4850
SHA5120dde24cace9dd5382733c853d816361c76558f931b5ea663cb43a97030aa24bd5357e886364e8aa1393a620e5f38c3c5e6efe749d7480fe673e9368a861c1cee
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
102KB
MD558174445e23753c941d39dc0453ac348
SHA140e3a9047c49cbae6818297adcd03896d28364c2
SHA2561e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171
SHA512523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072
-
Filesize
759B
MD5b9ea4293ed9eaa7b8e9bcf19c5e931b3
SHA11e993bb4b36e2f026c4cadff3fb9ee075b4960e4
SHA256f9ddd9391722224ed598a7cb13dea6c70b455abff41f9d4ea918e281a2434023
SHA512676a1c3815724571443621ff20ff0148384303af96ac8aa0a96e8d4d0feef18388c7b6fbe1fb372948adfefc60172d9f1fca81734bbb0c461c363aca15fccd7b