Resubmissions

28-10-2024 00:28

241028-asb7lawcqb 10

21-10-2024 19:42

241021-yemm6ssdnd 10

Analysis

  • max time kernel
    134s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-10-2024 19:42

General

  • Target

    FireFoxSetup.exe

  • Size

    171KB

  • MD5

    014b0ea8fe05df0fdea1710537dabe57

  • SHA1

    91b47cd15009aceba1040cadabf3aa7cd6279a48

  • SHA256

    340830c7cba818a4e94a7791432f6a3e29bf103ebb47c70a6cb61e53c0ee5b2a

  • SHA512

    8503e8cd78442535226f41ba5d12dc0a20732940a24f865eb156ab9e75d6b4330bfdd10abba8add37713447317280f7b30f8c30bfb9f8642d15506a17e4d12d0

  • SSDEEP

    1536:qDEV10wHVJKuuwhSMEFv9by6POwWTCs6se7llqn17KineXd2wVKtivEYoNRh8RXt:dfjhaFv9bjOwFsgbcUieNJqKoPC5+Ls

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.185.221.22:43768

Mutex

2bRkaANDDdoPipKE

Attributes
  • Install_directory

    %AppData%

  • install_file

    FireFox.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FireFoxSetup.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\FireFox.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FireFox.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1280
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FireFox" /tr "C:\Users\Admin\AppData\Roaming\FireFox.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2540
  • C:\Users\Admin\AppData\Roaming\FireFox.exe
    C:\Users\Admin\AppData\Roaming\FireFox.exe
    1⤵
    • Executes dropped EXE
    PID:2776
  • C:\Users\Admin\AppData\Roaming\FireFox.exe
    C:\Users\Admin\AppData\Roaming\FireFox.exe
    1⤵
    • Executes dropped EXE
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FireFox.exe.log

    Filesize

    654B

    MD5

    16c5fce5f7230eea11598ec11ed42862

    SHA1

    75392d4824706090f5e8907eee1059349c927600

    SHA256

    87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

    SHA512

    153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    8592ba100a78835a6b94d5949e13dfc1

    SHA1

    63e901200ab9a57c7dd4c078d7f75dcd3b357020

    SHA256

    fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

    SHA512

    87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    b80469d923b4e5f339d0827b0d740583

    SHA1

    340891be6bbaf8e1249b0b435188f16376c6a806

    SHA256

    1a30d822a352c02da1a0e12a3f660c4515c0552b1d2c7bd70cf72777b07bfdb5

    SHA512

    93eab4b3b2393e1308dc1e0102a9bdddfee09af413ac161526a66c8c66fd76781c6917c52a7d4bc7ee7c48ef8444866072a4b3e2ee0334e8f4918ee91cde7f6a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    4c7e49a8dc997866705fc9149fb1f79f

    SHA1

    4e18ede13febfd38c4f5f77bf77b4bfb7adeae87

    SHA256

    c9af73b5d635065649f54f08c77b12705ea5fe91d86b4e44757f565f0bbb36cf

    SHA512

    4a3fe223728f7fd4e87c89de634e6e8b82fbaec281a67fc702cb1a01871c84649f4542a851c4ceace183f00ddf5b32d4268bfb845088c09b153e2c8ab7a3bcc0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    12ce32cdb860ea27c099070bd8739917

    SHA1

    0316c3dcd8f5926dc125427a2220526e53b2b1c6

    SHA256

    cea8621365f1e4a19ccdbc46ef431635352d68753fc939f7412df3181080f6bd

    SHA512

    69da9c85c8068dfcef7267154215047aa3743a80724b60558f22c66237e04b24737d14dea19b7d8d8a7236da32d4fe9b4a48af04f22f61f54c5a69af1bc0ca95

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ce2ap21.1lt.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Roaming\FireFox.exe

    Filesize

    171KB

    MD5

    014b0ea8fe05df0fdea1710537dabe57

    SHA1

    91b47cd15009aceba1040cadabf3aa7cd6279a48

    SHA256

    340830c7cba818a4e94a7791432f6a3e29bf103ebb47c70a6cb61e53c0ee5b2a

    SHA512

    8503e8cd78442535226f41ba5d12dc0a20732940a24f865eb156ab9e75d6b4330bfdd10abba8add37713447317280f7b30f8c30bfb9f8642d15506a17e4d12d0

  • memory/236-1-0x0000000000FA0000-0x0000000000FD0000-memory.dmp

    Filesize

    192KB

  • memory/236-189-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/236-0-0x00007FFACD663000-0x00007FFACD664000-memory.dmp

    Filesize

    4KB

  • memory/236-188-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/236-61-0x00007FFACD663000-0x00007FFACD664000-memory.dmp

    Filesize

    4KB

  • memory/3264-19-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-52-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-51-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-41-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-20-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-10-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

    Filesize

    9.9MB

  • memory/3264-9-0x00000207324B0000-0x0000020732526000-memory.dmp

    Filesize

    472KB

  • memory/3264-6-0x0000020719D80000-0x0000020719DA2000-memory.dmp

    Filesize

    136KB