Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 01:06

General

  • Target

    03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe

  • Size

    558KB

  • MD5

    dc50baff9f1bab10f1ebc24e0d77afc3

  • SHA1

    29f4429939e57666b8a57c2d7b95a4801fa7ca20

  • SHA256

    03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7

  • SHA512

    6249ae2e738515d2f453310ad8e9730334997796477f88f0e1a72086154b0348b07da7c651b835f8e8b84ac43452fd0d87b5c40400d8a9a6297e802ae045a152

  • SSDEEP

    6144:mujuIGjAOphSW579i8fB106f91hYC1l+W8GSAZ2nxKdn3wGK570:LRaAODHVrB/lDH8gZhdAY

Score
10/10

Malware Config

Extracted

Family

xworm

Mutex

سPيIXNtJمrCWpكxـاطMWEلD21LcبإA

Attributes
  • Install_directory

    %Port%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 19 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:432
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:476
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:592
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe
              3⤵
              • Drops file in System32 directory
              PID:824
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:1196
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              2⤵
                PID:668
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                2⤵
                • Modifies security service
                PID:756
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                2⤵
                  PID:808
                  • C:\Windows\system32\Dwm.exe
                    "C:\Windows\system32\Dwm.exe"
                    3⤵
                      PID:1172
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:848
                    • C:\Windows\system32\wbem\WMIADAP.EXE
                      wmiadap.exe /F /T /R
                      3⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      PID:2768
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {DA79F11A-1032-445B-BE09-AB397F63084B} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
                      3⤵
                        PID:1612
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService
                      2⤵
                        PID:960
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k NetworkService
                        2⤵
                          PID:236
                        • C:\Windows\System32\spoolsv.exe
                          C:\Windows\System32\spoolsv.exe
                          2⤵
                            PID:344
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                            2⤵
                              PID:1064
                            • C:\Windows\system32\taskhost.exe
                              "taskhost.exe"
                              2⤵
                                PID:1112
                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                2⤵
                                  PID:2036
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                  2⤵
                                    PID:2128
                                  • C:\Windows\system32\sppsvc.exe
                                    C:\Windows\system32\sppsvc.exe
                                    2⤵
                                      PID:1700
                                  • C:\Windows\system32\lsass.exe
                                    C:\Windows\system32\lsass.exe
                                    1⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:492
                                  • C:\Windows\system32\lsm.exe
                                    C:\Windows\system32\lsm.exe
                                    1⤵
                                      PID:500
                                    • C:\Windows\Explorer.EXE
                                      C:\Windows\Explorer.EXE
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1200
                                      • C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe"
                                        2⤵
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:2088
                                        • C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe
                                          "C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:2752
                                          • C:\Windows\System32\schtasks.exe
                                            "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"
                                            4⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2216
                                        • C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe
                                          "C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:2804
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 2088 -s 784
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1272
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "1265893036-1602445984-277767434-105589196215767837131921833493-5095607711299266280"
                                      1⤵
                                        PID:2688

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe

                                              Filesize

                                              34KB

                                              MD5

                                              64ffe7c0fa6ac22f5acafd3ceb4aca5b

                                              SHA1

                                              104182708267ee1a6da0e9e83cb04df83edae120

                                              SHA256

                                              6b5c2e9a2ef36412b2636236ade5530c59573b51b07fe224fd980911cbb7b976

                                              SHA512

                                              f136d69bb6be51cf7e1e6f0e4538cb951337cb278344b348e749f67a6f08c1df01264bd3275ed9a36b776dfb1b9b75f31f8bcec102f8b50d50913aa883b13066

                                            • C:\Windows\System32\Tasks\wzcsapi

                                              Filesize

                                              3KB

                                              MD5

                                              300d054988447b260f9de0083d1f9ace

                                              SHA1

                                              e49af49e988961b8e1d16f76230b64f5cdc4d4db

                                              SHA256

                                              9de6a87751e0b83b937860198bf27e4fbfe915396f4c222ee6dd6ccb3cf3be64

                                              SHA512

                                              d6ab9c70dcd8430250b5b29a00ec1057eab752c0f12c737a15023fc2a195fd34d5b6ce55440a5aadc2fc9bf2e24797f1fd981144764073d6984a56e1eb27099a

                                            • C:\Windows\System32\perfc007.dat

                                              Filesize

                                              141KB

                                              MD5

                                              0f3d76321f0a7986b42b25a3aa554f82

                                              SHA1

                                              7036bba62109cc25da5d6a84d22b6edb954987c0

                                              SHA256

                                              dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460

                                              SHA512

                                              bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0

                                            • C:\Windows\System32\perfc00A.dat

                                              Filesize

                                              150KB

                                              MD5

                                              540138285295c68de32a419b7d9de687

                                              SHA1

                                              1cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56

                                              SHA256

                                              33867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb

                                              SHA512

                                              7c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a

                                            • C:\Windows\System32\perfc00C.dat

                                              Filesize

                                              145KB

                                              MD5

                                              ce233fa5dc5adcb87a5185617a0ff6ac

                                              SHA1

                                              2e2747284b1204d3ab08733a29fdbabdf8dc55b9

                                              SHA256

                                              68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31

                                              SHA512

                                              1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

                                            • C:\Windows\System32\perfc010.dat

                                              Filesize

                                              142KB

                                              MD5

                                              d73172c6cb697755f87cd047c474cf91

                                              SHA1

                                              abc5c7194abe32885a170ca666b7cce8251ac1d6

                                              SHA256

                                              9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57

                                              SHA512

                                              7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

                                            • C:\Windows\System32\perfc011.dat

                                              Filesize

                                              114KB

                                              MD5

                                              1f998386566e5f9b7f11cc79254d1820

                                              SHA1

                                              e1da5fe1f305099b94de565d06bc6f36c6794481

                                              SHA256

                                              1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

                                              SHA512

                                              a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

                                            • C:\Windows\System32\perfh007.dat

                                              Filesize

                                              668KB

                                              MD5

                                              5026297c7c445e7f6f705906a6f57c02

                                              SHA1

                                              4ec3b66d44b0d44ec139bd1475afd100748f9e91

                                              SHA256

                                              506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc

                                              SHA512

                                              5be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d

                                            • C:\Windows\System32\perfh009.dat

                                              Filesize

                                              634KB

                                              MD5

                                              1c678ee06bd02b5d9e4d51c3a4ec2d2b

                                              SHA1

                                              90aa7fdfaaa37fb4f2edfc8efc3994871087dedb

                                              SHA256

                                              2d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3

                                              SHA512

                                              ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32

                                            • C:\Windows\System32\perfh00A.dat

                                              Filesize

                                              727KB

                                              MD5

                                              7d0bac4e796872daa3f6dc82c57f4ca8

                                              SHA1

                                              b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a

                                              SHA256

                                              ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879

                                              SHA512

                                              145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

                                            • C:\Windows\System32\perfh00C.dat

                                              Filesize

                                              727KB

                                              MD5

                                              5f684ce126de17a7d4433ed2494c5ca9

                                              SHA1

                                              ce1a30a477daa1bac2ec358ce58731429eafe911

                                              SHA256

                                              2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c

                                              SHA512

                                              4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

                                            • C:\Windows\System32\perfh010.dat

                                              Filesize

                                              722KB

                                              MD5

                                              4623482c106cf6cc1bac198f31787b65

                                              SHA1

                                              5abb0decf7b42ef5daf7db012a742311932f6dad

                                              SHA256

                                              eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

                                              SHA512

                                              afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

                                            • C:\Windows\System32\perfh011.dat

                                              Filesize

                                              406KB

                                              MD5

                                              54c674d19c0ff72816402f66f6c3d37c

                                              SHA1

                                              2dcc0269545a213648d59dc84916d9ec2d62a138

                                              SHA256

                                              646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

                                              SHA512

                                              4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

                                            • C:\Windows\System32\wbem\Performance\WmiApRpl.h

                                              Filesize

                                              3KB

                                              MD5

                                              b133a676d139032a27de3d9619e70091

                                              SHA1

                                              1248aa89938a13640252a79113930ede2f26f1fa

                                              SHA256

                                              ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

                                              SHA512

                                              c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

                                            • C:\Windows\System32\wbem\Performance\WmiApRpl.ini

                                              Filesize

                                              27KB

                                              MD5

                                              46d08e3a55f007c523ac64dce6dcf478

                                              SHA1

                                              62edf88697e98d43f32090a2197bead7e7244245

                                              SHA256

                                              5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614

                                              SHA512

                                              b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

                                            • \Users\Admin\AppData\Local\Temp\wzcsvc.exe

                                              Filesize

                                              161KB

                                              MD5

                                              a69c6e092d415063a9fb80f8fe4e3444

                                              SHA1

                                              8b26a0fd01b1e48f7110cffecf6bc3b9d0822e9a

                                              SHA256

                                              f7dd8d6299c108a3221c31bf33637f59f0e19703aaa88b1e3a4f1093e7209a5d

                                              SHA512

                                              4e69b49d65f68ff913afbc991f06509645ac69850182f557ca625ad5cf92832059ddadb4af547cfb4fd84c4b24cf55a1ce3d9d6d466112e9581908d4e4d2da38

                                            • memory/432-28-0x000007FEBE0E0000-0x000007FEBE0F0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/432-29-0x0000000037750000-0x0000000037760000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/432-26-0x0000000000380000-0x00000000003A5000-memory.dmp

                                              Filesize

                                              148KB

                                            • memory/432-24-0x0000000000380000-0x00000000003A5000-memory.dmp

                                              Filesize

                                              148KB

                                            • memory/432-27-0x0000000000BB0000-0x0000000000BDB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/476-44-0x00000000001C0000-0x00000000001EB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/476-46-0x000007FEBE0E0000-0x000007FEBE0F0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/476-47-0x0000000037750000-0x0000000037760000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2088-0-0x000007FEF5A83000-0x000007FEF5A84000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2088-275-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/2088-5-0x00000000001A0000-0x00000000001C0000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/2088-4-0x0000000000160000-0x000000000018A000-memory.dmp

                                              Filesize

                                              168KB

                                            • memory/2088-3-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/2088-2-0x00000000003D0000-0x0000000000430000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2088-1-0x0000000000A50000-0x0000000000AE0000-memory.dmp

                                              Filesize

                                              576KB

                                            • memory/2752-247-0x000000001ABA0000-0x000000001ABAE000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/2752-15-0x0000000000F60000-0x0000000000F6E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/2804-23-0x00000000775F0000-0x000000007770F000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2804-22-0x0000000077710000-0x00000000778B9000-memory.dmp

                                              Filesize

                                              1.7MB