Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 04:48
Behavioral task
behavioral1
Sample
5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe
Resource
win10v2004-20240709-en
General
-
Target
5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe
-
Size
67KB
-
MD5
dca3c51239ffcd016b774d7155d18c5a
-
SHA1
ce2be9c645d7cf5b506e7cc4051ae6af1f443f57
-
SHA256
5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76
-
SHA512
2e8c1735233701dc6cebd207054224c49f2e745c6004f5656a97b567e66505c8cd1eef7b376fa5667df586586ad5ddc4000af01cab79ab2d36584f044f0c5bfa
-
SSDEEP
1536:Gye+8rrczLw512bjrW/b5DQY6zOiIQqJ0:0GLrb3W1uOiI30
Malware Config
Extracted
xworm
3.1
girl-tries.gl.at.ply.gg:7131
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/1216-1-0x0000000000150000-0x0000000000168000-memory.dmp family_xworm behavioral2/files/0x00100000000233c8-48.dat family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3708 powershell.exe 408 powershell.exe 2732 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.lnk 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.lnk 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Executes dropped EXE 3 IoCs
pid Process 2476 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 4988 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 4400 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76 = "C:\\Users\\Admin\\AppData\\Roaming\\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe" 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3708 powershell.exe 3708 powershell.exe 408 powershell.exe 408 powershell.exe 2732 powershell.exe 2732 powershell.exe 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe Token: SeDebugPrivilege 3708 powershell.exe Token: SeDebugPrivilege 408 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe Token: SeDebugPrivilege 2476 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe Token: SeDebugPrivilege 4988 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe Token: SeDebugPrivilege 4400 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1216 wrote to memory of 3708 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 87 PID 1216 wrote to memory of 3708 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 87 PID 1216 wrote to memory of 408 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 89 PID 1216 wrote to memory of 408 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 89 PID 1216 wrote to memory of 2732 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 91 PID 1216 wrote to memory of 2732 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 91 PID 1216 wrote to memory of 4672 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 93 PID 1216 wrote to memory of 4672 1216 5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe"C:\Users\Admin\AppData\Local\Temp\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76" /tr "C:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4672
-
-
C:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exeC:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
C:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exeC:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
C:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exeC:\Users\Admin\AppData\Roaming\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\5a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76.exe.log
Filesize654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5b51dc9e5ec3c97f72b4ca9488bbb4462
SHA15c1e8c0b728cd124edcacefb399bbd5e25b21bd3
SHA256976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db
SHA5120e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
67KB
MD5dca3c51239ffcd016b774d7155d18c5a
SHA1ce2be9c645d7cf5b506e7cc4051ae6af1f443f57
SHA2565a3ab5f3b0d3588e3e3e83402f1676334c6a37b951f8ef78a212044682ddcc76
SHA5122e8c1735233701dc6cebd207054224c49f2e745c6004f5656a97b567e66505c8cd1eef7b376fa5667df586586ad5ddc4000af01cab79ab2d36584f044f0c5bfa