Overview

overview

10

Static

static

10

fix.exe

windows10-2004-x64

fix.exe

windows7-x64

fix.exe

windows10-1703-x64

fix.exe

windows10-2004-x64

fix.exe

windows11-21h2-x64

Resubmissions

01-07-2024 12:05

240701-n9bt2s1akf 10

01-07-2024 11:59

240701-n5w97atdqr 10

Analysis

  • max time kernel
    230s
  • max time network
    234s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-07-2024 12:05

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    fix.exe

  • Size

    35KB

  • MD5

    83bbe29b99a54bad48074efb72ce1fcc

  • SHA1

    421deeba13130a8eebacc8c7f48f28e6fe8485f2

  • SHA256

    99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082

  • SHA512

    67fe2ac907c297cd3c4d1af7f80257b468bc4e73cab428568ea1238d41cd8c43262765a0b0d43b2accb003901a66e9e7ec162fefda2fd89040697e1e168ac27f

  • SSDEEP

    768:ChiLce92aOrsQiUy5FyS9ZL6LOjhibold:ChkceWsQi5FT9ZL6LOjGo7

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

20.ip.gl.ply.gg:53765

Mutex

JCfj6Aifpywc6Ul9

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fix.exe
    "C:\Users\Admin\AppData\Local\Temp\fix.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fix.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fix.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4724
    • C:\Windows\SYSTEM32\shutdown.exe
      shutdown.exe /f /s /t 0
      2⤵
        PID:4292
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aed855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      ad5cd538ca58cb28ede39c108acb5785

      SHA1

      1ae910026f3dbe90ed025e9e96ead2b5399be877

      SHA256

      c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

      SHA512

      c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      0dd991baa472b4eedd84b192247e5c17

      SHA1

      6747dfb038342c655b26f51fe4b2b042465969d1

      SHA256

      061ebf886c147e4a789b9fdc7705ef401a965afec5edd86ddd0448e6c599bd42

      SHA512

      a68d138949bce65356bf6dbda1bb53d053702f62e527601910fe7ebec98e8c43eecf8628b06094534e0dde28a16a5647f685038cd11ec33f251255b70d025cf6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      cc8d5dd849c53ca6233dc5f30f95253e

      SHA1

      0b579a784d1695c48c59b798fc117496b30965c1

      SHA256

      580cd55037fee3f604255fd7c19f76cb62c660d95e90e39ac74d28d7fd3918e3

      SHA512

      2dbe5ae07690178e54c151fb75956a05fa32aaeb91c397d5c254074ea91c57a10494eec7966309ce54fb1e56285045a3d118b3f47c2860d962bfd0399732a902

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      072e1c480863f9f441d3aa4e09368bc0

      SHA1

      0214dee9626c0425b0cd2291a0ac44c7eddfc617

      SHA256

      f5826e70ba4dabd99b8895e2edb21cc5ebc633864dcb708f45e1af0596c44bb5

      SHA512

      32f627c889731637da8ccdb00a181ba41cd6fb8d12f4520885399da4f5d21ce54c9d30699c3e2745a217af3e3d88fa81c5029f0fe26796ad0eebd24d019e7815

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qh3qj21u.see.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • memory/204-184-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/204-1-0x0000000000F30000-0x0000000000F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/204-188-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/204-187-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/204-186-0x000000001BBD0000-0x000000001BBDC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/204-185-0x00007FFA9F7A3000-0x00007FFA9F7A4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/204-0-0x00007FFA9F7A3000-0x00007FFA9F7A4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2372-48-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2372-6-0x000001C5439E0000-0x000001C543A02000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2372-10-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2372-9-0x000001C55C170000-0x000001C55C1E6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/2372-52-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2372-11-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2372-41-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2372-24-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

      Filesize

      9.9MB

      Download