Analysis

  • max time kernel
    164s
  • max time network
    200s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-05-2024 09:00

General

  • Target

    проверка.exe

  • Size

    102KB

  • MD5

    58174445e23753c941d39dc0453ac348

  • SHA1

    40e3a9047c49cbae6818297adcd03896d28364c2

  • SHA256

    1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

  • SHA512

    523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

  • SSDEEP

    1536:oBFpc8Z5dGYzabvawh+/C6vSX/QOcy/WPPqUs/uoDjSBSc7UtYVL:oa85dGCabvaw4/moOcy/R/1W0cgteL

Malware Config

Extracted

Family

xworm

C2

19.ip.gl.ply.gg:65468

speed-wheat.gl.at.ply.gg:65468

XWorm V5.2:123

Attributes
  • Install_directory

    %AppData%

  • install_file

    Delta.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\проверка.exe
    "C:\Users\Admin\AppData\Local\Temp\проверка.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4244
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1304
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1680
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:3396
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:2456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Delta.exe.log

    Filesize

    654B

    MD5

    16c5fce5f7230eea11598ec11ed42862

    SHA1

    75392d4824706090f5e8907eee1059349c927600

    SHA256

    87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

    SHA512

    153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    ad5cd538ca58cb28ede39c108acb5785

    SHA1

    1ae910026f3dbe90ed025e9e96ead2b5399be877

    SHA256

    c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

    SHA512

    c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    9e96a46c252a414a503bc7bec8d268ee

    SHA1

    41e23367c4109d4e657593e19f12f147e5815c0c

    SHA256

    52deea3f86609b31108f4e4519cd5c5019918407eff3bf437118e1f6993158d5

    SHA512

    87df7e9cd60354904a762f1df7ac8162cfcae456288703d943d65bef9e0cbfa8b7fdfcff1facf252268b063d004bf3a80d5d7512dda9d362ee7be7b6d2358068

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    13d801f8c5fcbb59a71d544b74f47bc3

    SHA1

    d6998e4c774a5ad98045abca3c4f31485e5c5ae2

    SHA256

    b3ad2c8e2aff2a1ad41ae434d4912b48fb8a3a5514d9f080d95bb68db18e402c

    SHA512

    a76f7a61fe572a2343fd4127b33bbf93cc9c4c5394a82a9cc0dab04090351318c3e1df87e14cd190846ff35c7161084c473a5091da1727993ffc21df67fb14f2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    863b33d71f0ac94388c541e5b1a1f04c

    SHA1

    f75d024a7ab5c150c4ae0b41543606e1752df962

    SHA256

    0bf5d47a16ed2e8a7b8121e77484d29d969ca8f450d8756eaba1c738788e4850

    SHA512

    0dde24cace9dd5382733c853d816361c76558f931b5ea663cb43a97030aa24bd5357e886364e8aa1393a620e5f38c3c5e6efe749d7480fe673e9368a861c1cee

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_paurilsi.g5i.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Roaming\Delta.exe

    Filesize

    102KB

    MD5

    58174445e23753c941d39dc0453ac348

    SHA1

    40e3a9047c49cbae6818297adcd03896d28364c2

    SHA256

    1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

    SHA512

    523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Delta.lnk

    Filesize

    759B

    MD5

    b9ea4293ed9eaa7b8e9bcf19c5e931b3

    SHA1

    1e993bb4b36e2f026c4cadff3fb9ee075b4960e4

    SHA256

    f9ddd9391722224ed598a7cb13dea6c70b455abff41f9d4ea918e281a2434023

    SHA512

    676a1c3815724571443621ff20ff0148384303af96ac8aa0a96e8d4d0feef18388c7b6fbe1fb372948adfefc60172d9f1fca81734bbb0c461c363aca15fccd7b

  • memory/4428-25-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-51-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-52-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-24-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-19-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-10-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4428-9-0x000001676A5C0000-0x000001676A636000-memory.dmp

    Filesize

    472KB

  • memory/4428-6-0x000001676A2E0000-0x000001676A302000-memory.dmp

    Filesize

    136KB

  • memory/4460-0-0x00007FFA72F73000-0x00007FFA72F74000-memory.dmp

    Filesize

    4KB

  • memory/4460-194-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4460-196-0x00007FFA72F70000-0x00007FFA7395C000-memory.dmp

    Filesize

    9.9MB

  • memory/4460-1-0x00000000005F0000-0x0000000000610000-memory.dmp

    Filesize

    128KB