Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 03:20

General

  • Target

    WizClient2.exe

  • Size

    75KB

  • MD5

    f19b33379b749f757bb47c0866af8808

  • SHA1

    a6c2232d04376cbe0ce75ac09bd7d86477b4a5da

  • SHA256

    2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103

  • SHA512

    c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11

  • SSDEEP

    1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq

Malware Config

Extracted

Family

xworm

C2

fe80::edf5:92cd:756d:3fbd%9:5552

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 6 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizClient2.exe
    "C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2784
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient2" /tr "C:\Users\Admin\AppData\Roaming\WizClient2.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2152
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {73AC7271-2A3D-4E0A-B940-3515BAEE907F} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2088
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1208

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          32cda20ff56f9f2c531aed0995265f86

          SHA1

          06bc2bbbf2ca23eb00091e39ff3ef325950da483

          SHA256

          90211d8a0199461325b3504c38bc3c7a6d0db68c9fae85c4a46c69fce3cb7564

          SHA512

          61e0db80ec030e925611a53c9c1f82a352498932038ea878905b77245b39368e02b7359748dea9c967992aeeebcbd5e48c632d80c4f2c7b5ca5c1bab501da7b5

        • C:\Users\Admin\AppData\Roaming\WizClient2.exe

          Filesize

          75KB

          MD5

          f19b33379b749f757bb47c0866af8808

          SHA1

          a6c2232d04376cbe0ce75ac09bd7d86477b4a5da

          SHA256

          2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103

          SHA512

          c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11

        • memory/1104-36-0x00000000000F0000-0x000000000010A000-memory.dmp

          Filesize

          104KB

        • memory/1208-41-0x00000000013B0000-0x00000000013CA000-memory.dmp

          Filesize

          104KB

        • memory/1748-8-0x0000000001E10000-0x0000000001E18000-memory.dmp

          Filesize

          32KB

        • memory/1748-7-0x000000001B630000-0x000000001B912000-memory.dmp

          Filesize

          2.9MB

        • memory/1748-6-0x0000000002AC0000-0x0000000002B40000-memory.dmp

          Filesize

          512KB

        • memory/2088-39-0x0000000000C30000-0x0000000000C4A000-memory.dmp

          Filesize

          104KB

        • memory/2724-15-0x0000000001E00000-0x0000000001E08000-memory.dmp

          Filesize

          32KB

        • memory/2724-14-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

          Filesize

          2.9MB

        • memory/3012-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

          Filesize

          4KB

        • memory/3012-30-0x000000001B1F0000-0x000000001B270000-memory.dmp

          Filesize

          512KB

        • memory/3012-31-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

          Filesize

          4KB

        • memory/3012-32-0x000000001B1F0000-0x000000001B270000-memory.dmp

          Filesize

          512KB

        • memory/3012-1-0x00000000011F0000-0x000000000120A000-memory.dmp

          Filesize

          104KB