Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 03:24

General

  • Target

    WizClient2.exe

  • Size

    75KB

  • MD5

    f19b33379b749f757bb47c0866af8808

  • SHA1

    a6c2232d04376cbe0ce75ac09bd7d86477b4a5da

  • SHA256

    2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103

  • SHA512

    c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11

  • SSDEEP

    1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq

Malware Config

Extracted

Family

xworm

C2

fe80::edf5:92cd:756d:3fbd%9:5552

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizClient2.exe
    "C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient2" /tr "C:\Users\Admin\AppData\Roaming\WizClient2.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2720
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {7902B381-DDEF-4CA5-A053-25CEFB16B899} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
    • C:\Users\Admin\AppData\Roaming\WizClient2.exe
      C:\Users\Admin\AppData\Roaming\WizClient2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1252

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          0b95a0eda657339db3909f3f0ac9ef7c

          SHA1

          35220b7dd889779cc24fbb89b844ed61cfa93ef3

          SHA256

          fa8eb5a6788151084a82ef302efdfadf6a304a3dc35b191d2f3163aee834efed

          SHA512

          43975d1104d34c530321395f80b4a42e0c5480898981ee129304fc611471be3756009231532fd4449151560cc338a4ce49837b70607f0e014226126e5a12d8eb

        • C:\Users\Admin\AppData\Roaming\WizClient2.exe

          Filesize

          75KB

          MD5

          f19b33379b749f757bb47c0866af8808

          SHA1

          a6c2232d04376cbe0ce75ac09bd7d86477b4a5da

          SHA256

          2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103

          SHA512

          c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11

        • memory/1492-15-0x0000000001E10000-0x0000000001E18000-memory.dmp

          Filesize

          32KB

        • memory/1492-14-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

          Filesize

          2.9MB

        • memory/1940-35-0x0000000001070000-0x000000000108A000-memory.dmp

          Filesize

          104KB

        • memory/2120-29-0x000000001B050000-0x000000001B0D0000-memory.dmp

          Filesize

          512KB

        • memory/2120-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

          Filesize

          4KB

        • memory/2120-30-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

          Filesize

          4KB

        • memory/2120-31-0x000000001B050000-0x000000001B0D0000-memory.dmp

          Filesize

          512KB

        • memory/2120-1-0x0000000000C40000-0x0000000000C5A000-memory.dmp

          Filesize

          104KB

        • memory/2348-8-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

          Filesize

          32KB

        • memory/2348-7-0x000000001B830000-0x000000001BB12000-memory.dmp

          Filesize

          2.9MB

        • memory/2348-6-0x0000000002D10000-0x0000000002D90000-memory.dmp

          Filesize

          512KB