Overview

overview

10

Static

static

3

adw.exe

windows7-x64

10

adw.exe

windows10-2004-x64

Analysis

  • max time kernel
    897s
  • max time network
    909s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 10:38

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    adw.exe

  • Size

    110KB

  • MD5

    873d23b0d914da099007377274719e4e

  • SHA1

    e821620eecd5231f8e529fd2496fee2ab07e34ff

  • SHA256

    9615a875deff7d17a7ca2d968bf3b65360d1f6f58babb85db3f158ffbe50fa3b

  • SHA512

    591d3de2e2c474d8bedbd9ebbc7d262aadec3a995f5437bd5adf8de8210f45b671622938629aa73d6fca39718df4c2833a42ff557e8818fe4cc65a29e73c006c

  • SSDEEP

    1536:feOqrr19/Rt4mfKCAZKm+WVrB392RN6QWSOgqJEwKXONRl75X2iOb23lMgq59MF:WDvZiotm+Wxh4mQWSASIl75lOELFF

Score
10/10
stormkittyxwormcredential_accessdiscoveryexploitpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

dead-he.gl.at.ply.gg:57200

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Drops file in Drivers directory 1 IoCs
  • Possible privilege escalation attempt 3 IoCs
    exploit
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 16 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\adw.exe
    "C:\Users\Admin\AppData\Local\Temp\adw.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\svchost.exe
      "C:\Users\Admin\AppData\Local\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4496
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tphpqgex\tphpqgex.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB910.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D2242B2174E4E6999F64E721FBAFB3.TMP"
          4⤵
            PID:3920
        • C:\Windows\SYSTEM32\CMD.EXE
          "CMD.EXE"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4888
          • C:\Windows\system32\notepad.exe
            notepad ISEEYOU!.txt
            4⤵
              PID:4772
            • C:\Windows\system32\notepad.exe
              notepad ISEEYOU!.txt
              4⤵
                PID:2012
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im notepad.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4252
            • C:\Windows\SYSTEM32\CMD.EXE
              "CMD.EXE"
              3⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:3820
              • C:\Windows\system32\takeown.exe
                takeown /f C:\Windows\System32
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:3972
              • C:\Windows\system32\icacls.exe
                icacls /grant Admin:F
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:1348
              • C:\Windows\system32\icacls.exe
                icacls C:\Windows\System32 /grant Admin:F
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:5056
            • C:\Windows\SYSTEM32\CMD.EXE
              "CMD.EXE"
              3⤵
                PID:1444
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1636
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:372
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4192
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4000
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4100
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3040
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3724
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4884
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3084
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3964
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5020
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5084
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2216
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4240
          • C:\Users\Public\svchost.exe
            C:\Users\Public\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1760

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Scripting

          1
          T1064

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          File and Directory Permissions Modification

          1
          T1222

          Modify Registry

          1
          T1112

          Scripting

          1
          T1064

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
            Filesize

            654B

            MD5

            2ff39f6c7249774be85fd60a8f9a245e

            SHA1

            684ff36b31aedc1e587c8496c02722c6698c1c4e

            SHA256

            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

            SHA512

            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RESB910.tmp
            Filesize

            1KB

            MD5

            e7ad56e0ce179f0dc3ea4efcad812897

            SHA1

            7b3cedcd434b9f5b67f3e047e782c8b8abbd736f

            SHA256

            7a86deeb1d8df78aad588827652cadb7f0101f03e2980735b3340b11efc42733

            SHA512

            2bced71efde8101b5a56cd7e29e72693ae62d03b40911e0ba1e3fa701e332de3ec66a4011d44366a69cf6580db2a05d8e8d92e917a3d3d5f05222493a3d3b0c4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0o1w5ywm.mis.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tphpqgex\tphpqgex.0.vb
            Filesize

            392B

            MD5

            45eca2df14237e5c950c802cfde11aaf

            SHA1

            a0f28115fbd8641d21d2520c046a6043db92681c

            SHA256

            9d536a412032ad2a3a09d56d8a769d5efe6f1d1d8939b1c40d3cfad6c7a94598

            SHA512

            7b429e85865cfcc9692b06447289c25b38d153fb557c34931c1c995f5fc19b119eda0e387c62292f1f24cecc9cf6c5d81ea9e40efb7e41aa805050e65c7f3c6c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tphpqgex\tphpqgex.cmdline
            Filesize

            313B

            MD5

            b7e215b1ed2ecae8d5b613d0d03707f9

            SHA1

            6bb8a7cf252fb79bf4ce912ccfa3e0849f3e34af

            SHA256

            d11fff319555946c7eec5fbc677ba796b8816592a52f8f3a67a284c9a7efc5c8

            SHA512

            88fb38df612f2bf12f3d7ec6a31baa56e3939667be92f92650a5479bb29bdfea5ed00c60f6d3ea9dffe8e343ab976027d1065abae9c3f6674d2f4849eda163c8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tphpqgex\tphpqgex.exe
            Filesize

            6KB

            MD5

            fabc547f31c44c55cffaded5be94c8c4

            SHA1

            babcadd7650d2a769c837142a320b36a28dffaba

            SHA256

            8148478faa92154b5895fd9cfc5bb9947a334d7bc17119095c87a9d4acf9ba85

            SHA512

            18eefce78004589241acf70130cd3751005b3cb34207fe18bb42dddd39d1b320722cc7643324a3edeec4fd739e71c6a714cc24f6c9d6539b1c2925275024e0c8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\vbc9D2242B2174E4E6999F64E721FBAFB3.TMP
            Filesize

            1KB

            MD5

            18e25637c536d026923bb26d664aca54

            SHA1

            5f84d16bab940b7b735c7471875915e8c29f3e7a

            SHA256

            78927921686b59efa3066668ebf457b5741685acd4da5a8382b56fbbc1c5e72e

            SHA512

            e6f9b88c2239899d519ae08e0efb7f1c46d4d0277419a63b09b7c75807d8fb7f928339ff102daa058d20ee6686c1ebbc52da1c226300813edf950e58402b3ff9

            Download Submit

          • C:\Users\Admin\AppData\Local\svchost.exe
            Filesize

            93KB

            MD5

            8d04dd1724cebcf83c6444a89f3cc284

            SHA1

            f3c70909956bbfb7807bfc816d198e8aa2d4928c

            SHA256

            c693a093fac8ddbfe9e2ba991df7fd70e685bad91ade6e9193802dabe8b64162

            SHA512

            f4582b3f8d98516cdbf77efb9acfd27b9cf687cdf75291b3f3bcb474a91f04947fbe6845c699e6abe9935c5a6089fde2ef256ee98fa512f8a3ce6c81d5f57e1c

            Download Submit

          • C:\Users\Admin\Desktop\ISEEYOU!.txt
            Filesize

            21B

            MD5

            e037958494f34df0ca377f83b3bb4198

            SHA1

            de502550a60da4925a82ba596e7f1bba24b8f28d

            SHA256

            18d60db1d85a47779296abb3a2e4121ccb4942b3f87b190be09d4eed3bcc3aa4

            SHA512

            b860146c3784a1164bd5769cc208c45c05bd2c5bb1ff12f9bbf52271f10f024e18be65b9290a4169448a134b7d76244aa84833ae2df50a00fa2404d36b11d298

            Download Submit

          • C:\Users\Admin\Desktop\ISEEYOU!.txt
            Filesize

            19B

            MD5

            7072efed0f9baa6babdf51280b579d75

            SHA1

            a63fd3866ee00d865b76c1d578fc219d31a1e210

            SHA256

            7f6eaf2daf71011798d879cfa9b7945cf97e39ae04887130e83e16b36ad5dd65

            SHA512

            5add0bf2af996425d63375ba0a0a2a140a59588b05221929c4e971e9e2bea6faf56d9ef01b5cee23e4b21603345a2008fca9354d89fd95856dbdd3e00143c63c

            Download Submit

          • memory/980-15-0x00007FF8E9270000-0x00007FF8E9D31000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/980-105-0x000000001D100000-0x000000001D10A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/980-40-0x000000001DB60000-0x000000001DB96000-memory.dmp

            Filesize

            216KB

            Download

          • memory/980-41-0x000000001BB60000-0x000000001BB6A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/980-42-0x000000001D740000-0x000000001D74E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/980-44-0x00000000203A0000-0x00000000204C0000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/980-83-0x000000001D950000-0x000000001D95C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/980-84-0x000000001FAD0000-0x000000001FFF8000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/980-85-0x000000001D970000-0x000000001D97A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/980-24-0x000000001DEB0000-0x000000001DEBE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/980-14-0x0000000000F10000-0x0000000000F2E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/980-34-0x000000001E9D0000-0x000000001E9F2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/980-37-0x000000001F250000-0x000000001F5A0000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/980-101-0x000000001D960000-0x000000001D968000-memory.dmp

            Filesize

            32KB

            Download

          • memory/980-35-0x000000001DF00000-0x000000001DF0C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/980-103-0x000000001D9A0000-0x000000001D9AA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/980-20-0x00007FF8E9270000-0x00007FF8E9D31000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/980-106-0x000000001D110000-0x000000001D11A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/980-108-0x000000001D120000-0x000000001D12A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2808-1-0x0000000000C60000-0x0000000000C82000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2808-0-0x00007FF8E9273000-0x00007FF8E9275000-memory.dmp

            Filesize

            8KB

            Download