Analysis
- max time kernel
42s - max time network
47s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
17/07/2024, 10:06
Behavioral task
behavioral1
Sample
XWorm V5.2.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
60 seconds
Behavioral task
behavioral2
Sample
XWorm V5.2.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
60 seconds
Behavioral task
behavioral3
Sample
XWormLoader 5.2 x32.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
60 seconds
Behavioral task
behavioral4
Sample
XWormLoader 5.2 x32.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
60 seconds
Behavioral task
behavioral5
Sample
XWormLoader 5.2 x64.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
60 seconds
General
- Target XWormLoader 5.2 x64.exe
- Size 109KB
- Sample240717-l5aebayfpe
- SHA256 b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2
- MD5 e6a20535b636d6402164a8e2d871ef6d
- SHA1 981cb1fd9361ca58f8985104e00132d1836a8736
- SHA512 35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30
- SSDEEP 1536:TYogSlNwXosKwOYtV1AS9m3xQyVGNNiLkWNF7XxFqmyVttdGFQeOPigx:TvgSlqGS9m3xQyKNbWNV3qmyBeu
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000014834e6d4e07e480dcaf391c91a7ebc2dd8dbe8ecefe69b6a563b4314924ce51000000000e800000000200002000000039ee3dcb2092dcc37d4740ac751d31b6b992e3bbf5b87f8ea6f21aae399f10869000000092bb4398d8d561a2f9c5798b06b52195667cd9325d36d731a52fa3e805f8ff1d4b7428954c2f106615644cb8cf4c7ec7fb7e28d6579478ce35c533e1c6f0fd2762792aad5aeffea10ae1e32840fd0ca9c97e22f86ff63bf0b563bc47971542e03cd6499092dd1fe63063b6fcc29a85b1c28c88231c4222f38e08008d8b20ae4fbaf9eb56915a9b329acde49f2dca839440000000eaab5f1788249d9bd273b51dfe63ca540cc5c4dccbd636f20b171d980c49628845f18e2015fde4e6faa9ff701cedb7025137f55932254366c006c9987650c7b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F7435E1-4424-11EF-AB0C-4605CC5911A3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107c816631d8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000006da09350c90872aa92898b6043757ce347302621c3120a9bbf84879ff43a1461000000000e800000000200002000000072e8a7690a1dd6491ddbbf9ab2143a0bfe607732ac7fc43ab1dd840aa15ba684200000009bdc353522e7242059dbe5129af88156f6c095afbb7745e0492a4444ff07ef754000000013a4c6f5aae32aabd3828c48d58d9653a934f9f7923bd83274affe1df514e12904b3360c2ad63e54168421e3202be77047836665fb82d57243a5eaf3371fc9fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1728 2544 XWormLoader 5.2 x64.exe 31 PID 2544 wrote to memory of 1728 2544 XWormLoader 5.2 x64.exe 31 PID 2544 wrote to memory of 1728 2544 XWormLoader 5.2 x64.exe 31 PID 1728 wrote to memory of 2276 1728 iexplore.exe 32 PID 1728 wrote to memory of 2276 1728 iexplore.exe 32 PID 1728 wrote to memory of 2276 1728 iexplore.exe 32 PID 1728 wrote to memory of 2276 1728 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe"C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=XWormLoader 5.2 x64.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e56b4b939dcd299a8c5fe869911ad7dfa063effdd02e6b0dae2d08f41e51d0ee
- MD5 e159385606ac3fb8f0a7be9cb40029d4
- SHA1 e702b52617fbf4f8ad5604ae3f2eb8ba456d5c0c
- SHA512 6fca18167b0a27914f8a8148596da7d215b0b52769ae5b6e1cbd1e90b83604d530967f0b9610058a3d0671f7bf49efba752f46766c5a81cf2ea5f909e94216fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 69b48a391b999078c855915676e4e3515c182d53a688a40572f2daec55239485
- MD5 54ab0a2fa1e42bf155e127ddeaabb324
- SHA1 b11c56c43be216e95baafb12da8d6ad85c8ee791
- SHA512 2c307bc27692bb1575212180b994d48fe1dc99d4e6888687204121d63678a3b85b7b8f23e0bc96f949376e44962139c12c8597e1f9cd758c37e31d8d05b72a91
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 26e994fe7945e0c93a8ee1f7503092afb8efe2fdf40c10a7e69d61f70844c360
- MD5 2a3db6653074c46b7246566845a73c40
- SHA1 40396ddd0fa8a0e56b1198752285e05c4d0817c1
- SHA512 e6ff57c8ff2042a5f28cfee4bc322bf72293c2f15f571b0e0f9d68aaf61627fde64730dce97f672233559b7174be3cb78f9ba909711e547db8817b24ebe4c1ab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f06f35cfbe97dc31da472419a3361d1f79ab85c6ae8d9ad6aa7bebadacb25b40
- MD5 55ec5cebcb8ca0d2b1c6108c05714384
- SHA1 2b443986dc2fa586fcc5cd023355a29e19391533
- SHA512 b04d2c6f0743b2d4432d9c304504985def32cde7f367ba7751b1d32b8d72d52d15a5429c229956ac56abcbee070a3f95c05352e7641bd805172ad43621682648
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3a333289a682aedb5f68ce7dea1d780ec5c5adb8c19594bdd2908a46b1ad0494
- MD5 3398de2c989c9eccbbe7b63e26d0e851
- SHA1 ce363f8f53e914028598f4235c8af4fa2b7fe85b
- SHA512 e1cccf285f18d6fae9f0a4d0190280a0b28d94dc31ab0660d18b67ee496f39ea5ada2e78d387c9c0799b85f52be5f82491a78c479ef52113e7ccef63fe92475b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b73d1e5964bbca017f2022a2a7c4d3d15e6b0b3861a40e7a8781bc715790c990
- MD5 52f5b361524ae86c2703d27c5528140a
- SHA1 0dd9dd873f46bf5ac705331fde4b873f275a6ca7
- SHA512 523eb3c12a5b20982804d2d685cf2a9eca1cc01af5bd28a3cb1702f2b180c8eaa31e9c9a25e3870b4c75995628c648230ebb435672cb5a0aafeec8c5ec50a7fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1fbad84a068b014afef56bed378a9efb71b97849d5fc8731a95a50d93d22ac94
- MD5 51f174a9a1eeeeaaa47c00acdf2fe183
- SHA1 df6cf21ec0ea8be711ef9ec22209b5b4e5d01fb5
- SHA512 81634583dad461dd29683d23b4546f9ade3171bd31573414124119deca4cf1ab3d7b92af0226de0e4140f63cfdda019280b963226f2413ecc4d2703cb3dd0a61
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3173b04b309037d4701774453ec09942e0fa36888944b50899c7d02afa681280
- MD5 4e191e26b99c948adfae1e7a221c33d7
- SHA1 2c9c26db44fcc8202a74ce4e4731d261258aeb36
- SHA512 66f7b077725d299a37e21df1fe14bd9e976e96817948d64e410fb329b277207e475a96c20f7ec1ffbb282652f9bb8308f8a4b9b48825752a46ab68ff4f289dda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 df6f531ef019df7d0bfc552dad4c3bd88cc72b6790c0cd0f91a44cf4d8e10988
- MD5 0f114bf253bea97d152b22b3377d2639
- SHA1 3411fa49d8ce08667c70ae88638b14d55c07e4cf
- SHA512 cdd351e715d6b6a255083a681842211b4e3799af645ecb41b55717095e71a665eb6c61445dd47cf07766fa8b088992b265f0e6758d34b442360e325a58f886f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d858cde2b53e20c008e63a335d64c028cf37139072cec46f72934f2bd9d0a721
- MD5 055b266882c3ea62099e218c8ec0630c
- SHA1 3ba12e4df75abd7f2390ad4bc13ae5e3aed99094
- SHA512 f2b3f09831bc978fa4936db07e5d2b3d6ad8461260fa0ed036e1b12320b07f0aed282d0e7cedd21f6ad784c1d0cfc93ef1ab5b7f397995be24334765438da17c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabB7BD.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarB7DF.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP