Overview

overview

10

Static

static

10

WaveTrial.exe

windows7-x64

10

WaveTrial.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    269s
  • max time network
    231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 16:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    WaveTrial.exe

  • Size

    86KB

  • MD5

    5cb8f4aa69339acc85ef9d2ca60b0c07

  • SHA1

    bb12de5f0a59eda98ba82e4a81dd24d80b8d7844

  • SHA256

    d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d

  • SHA512

    f8908f96cfff0498b977c2d790709cc02408068999f520a9727e3eff4e260092fd1c1b8fcf13d0cc217298f0e91a0b55fb30f88bba515fa08ed8b66465c07540

  • SSDEEP

    1536:VVOy37Fk3kKmog7DldgQatSL4Jj6+l7lbOL5zWx1fRkTqP6nPbuE1ONz5UrQWSK0:ctmog7DjgfmmbO14CP3ONzCrQC0

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:2619

20.ip.gl.ply.gg:2619
Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe
    "C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WaveTrial.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WaveLauncher'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3160
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WaveLauncher'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1300
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WaveLauncher" /tr "C:\Users\Admin\AppData\Roaming\WaveLauncher"
      2⤵
      • Creates scheduled task(s)
      PID:672
  • C:\Users\Admin\AppData\Roaming\WaveLauncher
    C:\Users\Admin\AppData\Roaming\WaveLauncher
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4360
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1436
  • C:\Users\Admin\AppData\Roaming\WaveLauncher
    C:\Users\Admin\AppData\Roaming\WaveLauncher
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2800
  • C:\Users\Admin\AppData\Roaming\WaveLauncher
    C:\Users\Admin\AppData\Roaming\WaveLauncher
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3940
  • C:\Users\Admin\AppData\Roaming\WaveLauncher
    C:\Users\Admin\AppData\Roaming\WaveLauncher
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2340

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaveLauncher.log
          Filesize

          654B

          MD5

          2ff39f6c7249774be85fd60a8f9a245e

          SHA1

          684ff36b31aedc1e587c8496c02722c6698c1c4e

          SHA256

          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

          SHA512

          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          6d42b6da621e8df5674e26b799c8e2aa

          SHA1

          ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

          SHA256

          5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

          SHA512

          53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          98f841e438be7b74f893cd4f792676d9

          SHA1

          e0d05b9e78482a1cd58c036056cf21d5e873bbdd

          SHA256

          6864d2e5a9cb45d2fe4a2712bcc936f14dd77f966bfce8003bdb290ffb40d08b

          SHA512

          d1b38e6e5a624e857bdb6214cf52dbdbdda77734b38af80608acef71474b86f5d2c5123601509577c0ee449062ad25980ebfe3e9bd7051f176ef22fa76e6cbba

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          6a5650126660a2760e93e48a63a9f626

          SHA1

          35710b657094c22ed66a37854173ce2090f02caa

          SHA256

          e981ba57e2617381d8d75f0c7ffb6e836afbeb475434a06b56b9a5a988761e92

          SHA512

          4e4cc9dc507cd95d5f9ddc181f68e97e5351aa7748c574717ac4cf0ff882f7fb1c6d6460b63560db382697c44118b8c2a288e2c94c9c8457b15ca6a9b1a66ba9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5skzs50.ycq.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WaveLauncher.lnk
          Filesize

          774B

          MD5

          c2035ab8fc742d971c17b490f7376be0

          SHA1

          7f16b59e04565c266e3fc174294e3c447d9dd800

          SHA256

          e8cd29260f7b14359f787783dcdb6699c8174cde73f5dfa0fcb6b8fa8e695f71

          SHA512

          c13a7d4ff2288dad93d4a6ec0efbea1f8547e74d09d891de04deebdf838f17cb115f44f392cb54c07990a68c1f263b92645a29d53e866329b526adbd1fb9af5d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\WaveLauncher
          Filesize

          86KB

          MD5

          5cb8f4aa69339acc85ef9d2ca60b0c07

          SHA1

          bb12de5f0a59eda98ba82e4a81dd24d80b8d7844

          SHA256

          d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d

          SHA512

          f8908f96cfff0498b977c2d790709cc02408068999f520a9727e3eff4e260092fd1c1b8fcf13d0cc217298f0e91a0b55fb30f88bba515fa08ed8b66465c07540

          Download Submit

        • memory/984-57-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/984-0-0x00000000006C0000-0x00000000006DC000-memory.dmp

          Filesize

          112KB

          Download

        • memory/984-56-0x00007FFDEBC23000-0x00007FFDEBC25000-memory.dmp

          Filesize

          8KB

          Download

        • memory/984-1-0x00007FFDEBC23000-0x00007FFDEBC25000-memory.dmp

          Filesize

          8KB

          Download

        • memory/984-55-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1436-72-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-73-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-68-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-62-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-63-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-64-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-74-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-69-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-70-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1436-71-0x000002653C370000-0x000002653C371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1964-13-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1964-17-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1964-14-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1964-12-0x00007FFDEBC20000-0x00007FFDEC6E1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1964-2-0x00000283B1BB0000-0x00000283B1BD2000-memory.dmp

          Filesize

          136KB

          Download