Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 03:24
Behavioral task
behavioral1
Sample
WizClient2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WizClient2.exe
Resource
win10v2004-20241007-en
General
-
Target
WizClient2.exe
-
Size
75KB
-
MD5
f19b33379b749f757bb47c0866af8808
-
SHA1
a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
-
SHA256
2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
-
SHA512
c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11
-
SSDEEP
1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq
Malware Config
Extracted
xworm
fe80::edf5:92cd:756d:3fbd%9:5552
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/memory/2120-1-0x0000000000C40000-0x0000000000C5A000-memory.dmp family_xworm behavioral1/files/0x0064000000011c27-27.dat family_xworm behavioral1/memory/1940-35-0x0000000001070000-0x000000000108A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2348 powershell.exe 1492 powershell.exe 2752 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient2.lnk WizClient2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient2.lnk WizClient2.exe -
Executes dropped EXE 3 IoCs
pid Process 1940 WizClient2.exe 2800 WizClient2.exe 1252 WizClient2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\WizClient2 = "C:\\Users\\Admin\\AppData\\Roaming\\WizClient2.exe" WizClient2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 WizClient2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 WizClient2.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2348 powershell.exe 1492 powershell.exe 2752 powershell.exe 2120 WizClient2.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2120 WizClient2.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 2120 WizClient2.exe Token: SeDebugPrivilege 1940 WizClient2.exe Token: SeDebugPrivilege 2800 WizClient2.exe Token: SeDebugPrivilege 1252 WizClient2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2120 WizClient2.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2348 2120 WizClient2.exe 31 PID 2120 wrote to memory of 2348 2120 WizClient2.exe 31 PID 2120 wrote to memory of 2348 2120 WizClient2.exe 31 PID 2120 wrote to memory of 1492 2120 WizClient2.exe 33 PID 2120 wrote to memory of 1492 2120 WizClient2.exe 33 PID 2120 wrote to memory of 1492 2120 WizClient2.exe 33 PID 2120 wrote to memory of 2752 2120 WizClient2.exe 35 PID 2120 wrote to memory of 2752 2120 WizClient2.exe 35 PID 2120 wrote to memory of 2752 2120 WizClient2.exe 35 PID 2120 wrote to memory of 2720 2120 WizClient2.exe 37 PID 2120 wrote to memory of 2720 2120 WizClient2.exe 37 PID 2120 wrote to memory of 2720 2120 WizClient2.exe 37 PID 832 wrote to memory of 1940 832 taskeng.exe 40 PID 832 wrote to memory of 1940 832 taskeng.exe 40 PID 832 wrote to memory of 1940 832 taskeng.exe 40 PID 832 wrote to memory of 2800 832 taskeng.exe 41 PID 832 wrote to memory of 2800 832 taskeng.exe 41 PID 832 wrote to memory of 2800 832 taskeng.exe 41 PID 832 wrote to memory of 1252 832 taskeng.exe 42 PID 832 wrote to memory of 1252 832 taskeng.exe 42 PID 832 wrote to memory of 1252 832 taskeng.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"C:\Users\Admin\AppData\Local\Temp\WizClient2.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient2" /tr "C:\Users\Admin\AppData\Roaming\WizClient2.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2720
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7902B381-DDEF-4CA5-A053-25CEFB16B899} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\WizClient2.exeC:\Users\Admin\AppData\Roaming\WizClient2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD50b95a0eda657339db3909f3f0ac9ef7c
SHA135220b7dd889779cc24fbb89b844ed61cfa93ef3
SHA256fa8eb5a6788151084a82ef302efdfadf6a304a3dc35b191d2f3163aee834efed
SHA51243975d1104d34c530321395f80b4a42e0c5480898981ee129304fc611471be3756009231532fd4449151560cc338a4ce49837b70607f0e014226126e5a12d8eb
-
Filesize
75KB
MD5f19b33379b749f757bb47c0866af8808
SHA1a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
SHA2562aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
SHA512c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11