Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21-10-2024 19:42
Behavioral task
behavioral1
Sample
FireFoxSetup.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
FireFoxSetup.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
FireFoxSetup.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
FireFoxSetup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FireFoxSetup.exe
Resource
win11-20241007-en
General
-
Target
FireFoxSetup.exe
-
Size
171KB
-
MD5
014b0ea8fe05df0fdea1710537dabe57
-
SHA1
91b47cd15009aceba1040cadabf3aa7cd6279a48
-
SHA256
340830c7cba818a4e94a7791432f6a3e29bf103ebb47c70a6cb61e53c0ee5b2a
-
SHA512
8503e8cd78442535226f41ba5d12dc0a20732940a24f865eb156ab9e75d6b4330bfdd10abba8add37713447317280f7b30f8c30bfb9f8642d15506a17e4d12d0
-
SSDEEP
1536:qDEV10wHVJKuuwhSMEFv9by6POwWTCs6se7llqn17KineXd2wVKtivEYoNRh8RXt:dfjhaFv9bjOwFsgbcUieNJqKoPC5+Ls
Malware Config
Extracted
xworm
5.0
147.185.221.22:43768
2bRkaANDDdoPipKE
-
Install_directory
%AppData%
-
install_file
FireFox.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral3/memory/236-1-0x0000000000FA0000-0x0000000000FD0000-memory.dmp family_xworm behavioral3/files/0x000d00000001ab40-191.dat family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3264 powershell.exe 4708 powershell.exe 2180 powershell.exe 1280 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FireFox.lnk FireFoxSetup.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FireFox.lnk FireFoxSetup.exe -
Executes dropped EXE 2 IoCs
pid Process 2776 FireFox.exe 2288 FireFox.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\FireFox = "C:\\Users\\Admin\\AppData\\Roaming\\FireFox.exe" FireFoxSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3264 powershell.exe 3264 powershell.exe 3264 powershell.exe 4708 powershell.exe 4708 powershell.exe 4708 powershell.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe 1280 powershell.exe 1280 powershell.exe 1280 powershell.exe 236 FireFoxSetup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 236 FireFoxSetup.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeIncreaseQuotaPrivilege 3264 powershell.exe Token: SeSecurityPrivilege 3264 powershell.exe Token: SeTakeOwnershipPrivilege 3264 powershell.exe Token: SeLoadDriverPrivilege 3264 powershell.exe Token: SeSystemProfilePrivilege 3264 powershell.exe Token: SeSystemtimePrivilege 3264 powershell.exe Token: SeProfSingleProcessPrivilege 3264 powershell.exe Token: SeIncBasePriorityPrivilege 3264 powershell.exe Token: SeCreatePagefilePrivilege 3264 powershell.exe Token: SeBackupPrivilege 3264 powershell.exe Token: SeRestorePrivilege 3264 powershell.exe Token: SeShutdownPrivilege 3264 powershell.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeSystemEnvironmentPrivilege 3264 powershell.exe Token: SeRemoteShutdownPrivilege 3264 powershell.exe Token: SeUndockPrivilege 3264 powershell.exe Token: SeManageVolumePrivilege 3264 powershell.exe Token: 33 3264 powershell.exe Token: 34 3264 powershell.exe Token: 35 3264 powershell.exe Token: 36 3264 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeIncreaseQuotaPrivilege 4708 powershell.exe Token: SeSecurityPrivilege 4708 powershell.exe Token: SeTakeOwnershipPrivilege 4708 powershell.exe Token: SeLoadDriverPrivilege 4708 powershell.exe Token: SeSystemProfilePrivilege 4708 powershell.exe Token: SeSystemtimePrivilege 4708 powershell.exe Token: SeProfSingleProcessPrivilege 4708 powershell.exe Token: SeIncBasePriorityPrivilege 4708 powershell.exe Token: SeCreatePagefilePrivilege 4708 powershell.exe Token: SeBackupPrivilege 4708 powershell.exe Token: SeRestorePrivilege 4708 powershell.exe Token: SeShutdownPrivilege 4708 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeSystemEnvironmentPrivilege 4708 powershell.exe Token: SeRemoteShutdownPrivilege 4708 powershell.exe Token: SeUndockPrivilege 4708 powershell.exe Token: SeManageVolumePrivilege 4708 powershell.exe Token: 33 4708 powershell.exe Token: 34 4708 powershell.exe Token: 35 4708 powershell.exe Token: 36 4708 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeIncreaseQuotaPrivilege 2180 powershell.exe Token: SeSecurityPrivilege 2180 powershell.exe Token: SeTakeOwnershipPrivilege 2180 powershell.exe Token: SeLoadDriverPrivilege 2180 powershell.exe Token: SeSystemProfilePrivilege 2180 powershell.exe Token: SeSystemtimePrivilege 2180 powershell.exe Token: SeProfSingleProcessPrivilege 2180 powershell.exe Token: SeIncBasePriorityPrivilege 2180 powershell.exe Token: SeCreatePagefilePrivilege 2180 powershell.exe Token: SeBackupPrivilege 2180 powershell.exe Token: SeRestorePrivilege 2180 powershell.exe Token: SeShutdownPrivilege 2180 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeSystemEnvironmentPrivilege 2180 powershell.exe Token: SeRemoteShutdownPrivilege 2180 powershell.exe Token: SeUndockPrivilege 2180 powershell.exe Token: SeManageVolumePrivilege 2180 powershell.exe Token: 33 2180 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 236 FireFoxSetup.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 236 wrote to memory of 3264 236 FireFoxSetup.exe 74 PID 236 wrote to memory of 3264 236 FireFoxSetup.exe 74 PID 236 wrote to memory of 4708 236 FireFoxSetup.exe 77 PID 236 wrote to memory of 4708 236 FireFoxSetup.exe 77 PID 236 wrote to memory of 2180 236 FireFoxSetup.exe 79 PID 236 wrote to memory of 2180 236 FireFoxSetup.exe 79 PID 236 wrote to memory of 1280 236 FireFoxSetup.exe 81 PID 236 wrote to memory of 1280 236 FireFoxSetup.exe 81 PID 236 wrote to memory of 2540 236 FireFoxSetup.exe 83 PID 236 wrote to memory of 2540 236 FireFoxSetup.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe"C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\FireFoxSetup.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FireFoxSetup.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\FireFox.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FireFox.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FireFox" /tr "C:\Users\Admin\AppData\Roaming\FireFox.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2540
-
-
C:\Users\Admin\AppData\Roaming\FireFox.exeC:\Users\Admin\AppData\Roaming\FireFox.exe1⤵
- Executes dropped EXE
PID:2776
-
C:\Users\Admin\AppData\Roaming\FireFox.exeC:\Users\Admin\AppData\Roaming\FireFox.exe1⤵
- Executes dropped EXE
PID:2288
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD5b80469d923b4e5f339d0827b0d740583
SHA1340891be6bbaf8e1249b0b435188f16376c6a806
SHA2561a30d822a352c02da1a0e12a3f660c4515c0552b1d2c7bd70cf72777b07bfdb5
SHA51293eab4b3b2393e1308dc1e0102a9bdddfee09af413ac161526a66c8c66fd76781c6917c52a7d4bc7ee7c48ef8444866072a4b3e2ee0334e8f4918ee91cde7f6a
-
Filesize
1KB
MD54c7e49a8dc997866705fc9149fb1f79f
SHA14e18ede13febfd38c4f5f77bf77b4bfb7adeae87
SHA256c9af73b5d635065649f54f08c77b12705ea5fe91d86b4e44757f565f0bbb36cf
SHA5124a3fe223728f7fd4e87c89de634e6e8b82fbaec281a67fc702cb1a01871c84649f4542a851c4ceace183f00ddf5b32d4268bfb845088c09b153e2c8ab7a3bcc0
-
Filesize
1KB
MD512ce32cdb860ea27c099070bd8739917
SHA10316c3dcd8f5926dc125427a2220526e53b2b1c6
SHA256cea8621365f1e4a19ccdbc46ef431635352d68753fc939f7412df3181080f6bd
SHA51269da9c85c8068dfcef7267154215047aa3743a80724b60558f22c66237e04b24737d14dea19b7d8d8a7236da32d4fe9b4a48af04f22f61f54c5a69af1bc0ca95
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
171KB
MD5014b0ea8fe05df0fdea1710537dabe57
SHA191b47cd15009aceba1040cadabf3aa7cd6279a48
SHA256340830c7cba818a4e94a7791432f6a3e29bf103ebb47c70a6cb61e53c0ee5b2a
SHA5128503e8cd78442535226f41ba5d12dc0a20732940a24f865eb156ab9e75d6b4330bfdd10abba8add37713447317280f7b30f8c30bfb9f8642d15506a17e4d12d0