Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 03:20
Behavioral task
behavioral1
Sample
WizClient2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WizClient2.exe
Resource
win10v2004-20241007-en
General
-
Target
WizClient2.exe
-
Size
75KB
-
MD5
f19b33379b749f757bb47c0866af8808
-
SHA1
a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
-
SHA256
2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
-
SHA512
c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11
-
SSDEEP
1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq
Malware Config
Extracted
xworm
fe80::edf5:92cd:756d:3fbd%9:5552
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 6 IoCs
resource yara_rule behavioral1/memory/3012-1-0x00000000011F0000-0x000000000120A000-memory.dmp family_xworm behavioral1/files/0x000a000000004e74-28.dat family_xworm behavioral1/memory/3012-30-0x000000001B1F0000-0x000000001B270000-memory.dmp family_xworm behavioral1/memory/1104-36-0x00000000000F0000-0x000000000010A000-memory.dmp family_xworm behavioral1/memory/2088-39-0x0000000000C30000-0x0000000000C4A000-memory.dmp family_xworm behavioral1/memory/1208-41-0x00000000013B0000-0x00000000013CA000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2724 powershell.exe 2784 powershell.exe 1748 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient2.lnk WizClient2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient2.lnk WizClient2.exe -
Executes dropped EXE 3 IoCs
pid Process 1104 WizClient2.exe 2088 WizClient2.exe 1208 WizClient2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\WizClient2 = "C:\\Users\\Admin\\AppData\\Roaming\\WizClient2.exe" WizClient2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 WizClient2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 WizClient2.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2152 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1748 powershell.exe 2724 powershell.exe 2784 powershell.exe 3012 WizClient2.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3012 WizClient2.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 3012 WizClient2.exe Token: SeDebugPrivilege 1104 WizClient2.exe Token: SeDebugPrivilege 2088 WizClient2.exe Token: SeDebugPrivilege 1208 WizClient2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3012 WizClient2.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1748 3012 WizClient2.exe 30 PID 3012 wrote to memory of 1748 3012 WizClient2.exe 30 PID 3012 wrote to memory of 1748 3012 WizClient2.exe 30 PID 3012 wrote to memory of 2724 3012 WizClient2.exe 32 PID 3012 wrote to memory of 2724 3012 WizClient2.exe 32 PID 3012 wrote to memory of 2724 3012 WizClient2.exe 32 PID 3012 wrote to memory of 2784 3012 WizClient2.exe 34 PID 3012 wrote to memory of 2784 3012 WizClient2.exe 34 PID 3012 wrote to memory of 2784 3012 WizClient2.exe 34 PID 3012 wrote to memory of 2152 3012 WizClient2.exe 36 PID 3012 wrote to memory of 2152 3012 WizClient2.exe 36 PID 3012 wrote to memory of 2152 3012 WizClient2.exe 36 PID 2860 wrote to memory of 1104 2860 taskeng.exe 40 PID 2860 wrote to memory of 1104 2860 taskeng.exe 40 PID 2860 wrote to memory of 1104 2860 taskeng.exe 40 PID 2860 wrote to memory of 2088 2860 taskeng.exe 41 PID 2860 wrote to memory of 2088 2860 taskeng.exe 41 PID 2860 wrote to memory of 2088 2860 taskeng.exe 41 PID 2860 wrote to memory of 1208 2860 taskeng.exe 42 PID 2860 wrote to memory of 1208 2860 taskeng.exe 42 PID 2860 wrote to memory of 1208 2860 taskeng.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient2" /tr "C:\Users\Admin\AppData\Roaming\WizClient2.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2152
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {73AC7271-2A3D-4E0A-B940-3515BAEE907F} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD532cda20ff56f9f2c531aed0995265f86
SHA106bc2bbbf2ca23eb00091e39ff3ef325950da483
SHA25690211d8a0199461325b3504c38bc3c7a6d0db68c9fae85c4a46c69fce3cb7564
SHA51261e0db80ec030e925611a53c9c1f82a352498932038ea878905b77245b39368e02b7359748dea9c967992aeeebcbd5e48c632d80c4f2c7b5ca5c1bab501da7b5
-
Filesize
75KB
MD5f19b33379b749f757bb47c0866af8808
SHA1a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
SHA2562aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
SHA512c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11