Analysis
- max time kernel
59s - max time network
61s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
17/07/2024, 10:06
Behavioral task
behavioral1
Sample
XWorm V5.2.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
60 seconds
Behavioral task
behavioral2
Sample
XWorm V5.2.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
60 seconds
Behavioral task
behavioral3
Sample
XWormLoader 5.2 x32.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
60 seconds
Behavioral task
behavioral4
Sample
XWormLoader 5.2 x32.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
60 seconds
Behavioral task
behavioral5
Sample
XWormLoader 5.2 x64.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
60 seconds
General
- Target XWormLoader 5.2 x32.exe
- Size 109KB
- Sample240717-l5aebayfpe
- SHA256 2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
- MD5 f3b2ec58b71ba6793adcc2729e2140b1
- SHA1 d9e93a33ac617afe326421df4f05882a61e0a4f2
- SHA512 473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495
- SSDEEP 1536:5vjAnXqn2nY7WfRMgPQQrMoqmyVttdGFQeOPigx:5LCan2nY7sdQQAoqmyBeu
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B2B3411-4424-11EF-A7C8-6EB28AAB65BF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2040 XWormLoader 5.2 x32.exe 1864 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1864 iexplore.exe 1864 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1864 2040 XWormLoader 5.2 x32.exe 32 PID 2040 wrote to memory of 1864 2040 XWormLoader 5.2 x32.exe 32 PID 2040 wrote to memory of 1864 2040 XWormLoader 5.2 x32.exe 32 PID 2040 wrote to memory of 1864 2040 XWormLoader 5.2 x32.exe 32 PID 1864 wrote to memory of 2196 1864 iexplore.exe 33 PID 1864 wrote to memory of 2196 1864 iexplore.exe 33 PID 1864 wrote to memory of 2196 1864 iexplore.exe 33 PID 1864 wrote to memory of 2196 1864 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x32.exe"C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x32.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=XWormLoader 5.2 x32.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9e1e4c9c4ce962fb5916907d0f929964cfe01444145704dd86cb91f15425bc37
- MD5 d0e623985316767305ae44c18f83e1c4
- SHA1 05bef3363dce1c77e902d82ded3f91ad07934470
- SHA512 9cdf06b348937be3ee4c212e20de75ff99c987e79d6a97c159642207caf0e6aecad69ce2f7807dc170992a85b872b1b1d4b1a377b8d0c8e7002be8eed8da4e8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d10e2a1b48066eb90be3d049f58f0e7e7d3a643f01380db0c887711853e950d8
- MD5 704c95c66ade81d909f50af54272fe9a
- SHA1 ff0253a0583d1ac9e1e35e08251ef9ba80d57700
- SHA512 a456fddb3482ce976f278f4462122e14130039bbda85e8d88b24fe4b13c6766410a6f27cedf259bd8e89d6b97c25049ecfa0ff8b0682167b1c4adb64a8313b52
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 176d111795f507af9efc0a436bae9dfabbe76c6ba1e4e315ea90888a14d38d17
- MD5 05cbc50be4036076d9b6915a86887dca
- SHA1 9b756f9f6a4fb4c2ddaa895fea6381658b5e8b9c
- SHA512 7293b4d6b15690aa25023a8596054a87de83a89572aa463a0eab697f828683f4dd08f243500dff5a15a2d521340a9a7c2759f4ebcce7a40115afc80bf95cbcd1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ada23ff0d66d1b60439536f9ebb2aeaa27ff28b5e3934fc24a04d61de18a4ff7
- MD5 ce6f042466f0f6d21089a56003565bd5
- SHA1 d1d6a5fa5184890aec79f39b38987fae48748a20
- SHA512 ef25ca9a9c6a36f59b707dafc36a350c37af214552d893bc1f049fbf8fd67cceae9cfc2c22b9825c2031a4edd1a65025250b1b94251e64ea21070c354103515f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 de58a0af1591e646486ff2d0411294e75c0e84d94441b9d664993f09f3186689
- MD5 888b07c2bf3ff84090ac70e03db6f6f8
- SHA1 85894cd19b2bb15bd09ac74d6036cce83e31cc5d
- SHA512 89e5a72bb4ee1e31effa243c40ef7f9f4e0aab3db9fb941c03d731ab9fa99e65f22e973965bac7cee48748a59534c81269196c4509ae3cea04c27c061608c6c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 acc1d4f25334d3035059a618e3c50bb1316103dda3a4b907a1a52216e105987c
- MD5 f85e393eeaa87caa32d5ed127cd1c610
- SHA1 4227cee6e1918dbe4facf4e27a68f46501b222cc
- SHA512 0f107085ab641a9e693daaf5b186beb2e98f993c61f83d82a002ef5a028177a7388a920a7c4bd6f75dae289219c412b9100f542756da3d16e6f0405a50221b66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab10B5.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar10D7.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP