Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 03:15
Behavioral task
behavioral1
Sample
WizClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WizClient.exe
Resource
win10v2004-20241007-en
General
-
Target
WizClient.exe
-
Size
74KB
-
MD5
69cad671f60367927329bbd20f91bed7
-
SHA1
9aa6c82982591ebc0c64cc94d2efaac7378bde86
-
SHA256
dc94e48f4fd4cdf8049e6ac2ea9b65df93936015c50e26d0c8d6b2217e7d539b
-
SHA512
bb4a49b2eada56d9d9c0fd7b7464447460e7bb84c6416f632295197562e65a456d33099799d3083684c45150ad362d036ee0eb843745272d5accab5ff9a525f4
-
SSDEEP
1536:ObGA+5D6BRZ2Ka+QRPPN7cmKuZbN5NTEkIG6QOj89RnXqDnnl:ObGpsBRZ4d9bZbN3EAOA9RnXqLl
Malware Config
Extracted
xworm
141.98.252.138.224:5552
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/memory/2096-1-0x00000000003A0000-0x00000000003B8000-memory.dmp family_xworm behavioral1/files/0x000a000000004e76-28.dat family_xworm behavioral1/memory/2952-36-0x00000000012A0000-0x00000000012B8000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2800 powershell.exe 2920 powershell.exe 2584 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk WizClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk WizClient.exe -
Executes dropped EXE 2 IoCs
pid Process 2952 WizClient.exe 2436 WizClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WizClient = "C:\\Users\\Admin\\AppData\\Roaming\\WizClient.exe" WizClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 WizClient.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 WizClient.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2800 powershell.exe 2920 powershell.exe 2584 powershell.exe 2096 WizClient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2096 WizClient.exe Token: SeDebugPrivilege 2800 powershell.exe Token: SeDebugPrivilege 2920 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2096 WizClient.exe Token: SeDebugPrivilege 2952 WizClient.exe Token: SeDebugPrivilege 2436 WizClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2096 WizClient.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2800 2096 WizClient.exe 30 PID 2096 wrote to memory of 2800 2096 WizClient.exe 30 PID 2096 wrote to memory of 2800 2096 WizClient.exe 30 PID 2096 wrote to memory of 2920 2096 WizClient.exe 32 PID 2096 wrote to memory of 2920 2096 WizClient.exe 32 PID 2096 wrote to memory of 2920 2096 WizClient.exe 32 PID 2096 wrote to memory of 2584 2096 WizClient.exe 34 PID 2096 wrote to memory of 2584 2096 WizClient.exe 34 PID 2096 wrote to memory of 2584 2096 WizClient.exe 34 PID 2096 wrote to memory of 1776 2096 WizClient.exe 36 PID 2096 wrote to memory of 1776 2096 WizClient.exe 36 PID 2096 wrote to memory of 1776 2096 WizClient.exe 36 PID 2976 wrote to memory of 2952 2976 taskeng.exe 40 PID 2976 wrote to memory of 2952 2976 taskeng.exe 40 PID 2976 wrote to memory of 2952 2976 taskeng.exe 40 PID 2976 wrote to memory of 2436 2976 taskeng.exe 41 PID 2976 wrote to memory of 2436 2976 taskeng.exe 41 PID 2976 wrote to memory of 2436 2976 taskeng.exe 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizClient.exe"C:\Users\Admin\AppData\Local\Temp\WizClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient" /tr "C:\Users\Admin\AppData\Roaming\WizClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1776
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B7E254FF-6907-4202-ADDC-DF28AF63AC7F} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Roaming\WizClient.exeC:\Users\Admin\AppData\Roaming\WizClient.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Users\Admin\AppData\Roaming\WizClient.exeC:\Users\Admin\AppData\Roaming\WizClient.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD53b77e1c65a0bb126cc0982c3655d64b5
SHA1a97023901694a13efdf76c995ba3b42de3e30c2e
SHA2560b6b98f6499cba5cdc10a99ead344275d034024425b17ffe2dc26fce6f4b894e
SHA512c6a10aaf5b07da744e4a385d725f3f4b002547dfde41b47896be1c2222379362a3599cd227e0fcab153dd4e13ac9b602de405fe33252f0591bf70dd98055ccd2
-
Filesize
74KB
MD569cad671f60367927329bbd20f91bed7
SHA19aa6c82982591ebc0c64cc94d2efaac7378bde86
SHA256dc94e48f4fd4cdf8049e6ac2ea9b65df93936015c50e26d0c8d6b2217e7d539b
SHA512bb4a49b2eada56d9d9c0fd7b7464447460e7bb84c6416f632295197562e65a456d33099799d3083684c45150ad362d036ee0eb843745272d5accab5ff9a525f4