Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 16:40
Behavioral task
behavioral1
Sample
mygame.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
mygame.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
mygame.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
mygame.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
mygame.exe
Resource
win11-20241007-en
General
-
Target
mygame.exe
-
Size
137KB
-
MD5
1a925fce50787a5028b73dd32e0c7dce
-
SHA1
7205d5c3d7efbc5805eb0b343a1bc83903e7589c
-
SHA256
00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3
-
SHA512
ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8
-
SSDEEP
3072:6fjh7Fv9fjOwiBz65/M6If+3Js+3JFkKeTno:8hJv9AxBt25
Malware Config
Extracted
xworm
5.0
147.185.221.23:48450
2YsFPOHVMLfmF9px
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral2/memory/2180-1-0x0000000000D60000-0x0000000000D88000-memory.dmp family_xworm behavioral2/files/0x000b00000001225f-35.dat family_xworm behavioral2/memory/1948-37-0x0000000000DB0000-0x0000000000DD8000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2552 powershell.exe 2724 powershell.exe 2904 powershell.exe 2636 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk mygame.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk mygame.exe -
Executes dropped EXE 2 IoCs
pid Process 1948 Update.exe 2456 Update.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" mygame.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2684 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2552 powershell.exe 2724 powershell.exe 2904 powershell.exe 2636 powershell.exe 2180 mygame.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2180 mygame.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 2904 powershell.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2180 mygame.exe Token: SeDebugPrivilege 1948 Update.exe Token: SeDebugPrivilege 2456 Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2180 mygame.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2552 2180 mygame.exe 30 PID 2180 wrote to memory of 2552 2180 mygame.exe 30 PID 2180 wrote to memory of 2552 2180 mygame.exe 30 PID 2180 wrote to memory of 2724 2180 mygame.exe 32 PID 2180 wrote to memory of 2724 2180 mygame.exe 32 PID 2180 wrote to memory of 2724 2180 mygame.exe 32 PID 2180 wrote to memory of 2904 2180 mygame.exe 34 PID 2180 wrote to memory of 2904 2180 mygame.exe 34 PID 2180 wrote to memory of 2904 2180 mygame.exe 34 PID 2180 wrote to memory of 2636 2180 mygame.exe 36 PID 2180 wrote to memory of 2636 2180 mygame.exe 36 PID 2180 wrote to memory of 2636 2180 mygame.exe 36 PID 2180 wrote to memory of 2684 2180 mygame.exe 38 PID 2180 wrote to memory of 2684 2180 mygame.exe 38 PID 2180 wrote to memory of 2684 2180 mygame.exe 38 PID 2052 wrote to memory of 1948 2052 taskeng.exe 43 PID 2052 wrote to memory of 1948 2052 taskeng.exe 43 PID 2052 wrote to memory of 1948 2052 taskeng.exe 43 PID 2052 wrote to memory of 2456 2052 taskeng.exe 44 PID 2052 wrote to memory of 2456 2052 taskeng.exe 44 PID 2052 wrote to memory of 2456 2052 taskeng.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mygame.exe"C:\Users\Admin\AppData\Local\Temp\mygame.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mygame.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mygame.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2684
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8699B8B3-7170-4412-B425-12F1850B0CFE} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5e554e42e963ad2467e9f9a9a79ff4363
SHA152e46ab0f9c0f3bca92ef7540f34291b18608e38
SHA25668d401e9157d87b3278d8bd255e694ee62fe02ced636127dac56a0d99de54ecd
SHA512ee7666af4ee889e255cc17753223080c63e8853edc38b644bd5b18c027db872b343577629b9bd66e3542ffbea2776765d0dce5e3e39a66d148922edfb1ca200d
-
Filesize
137KB
MD51a925fce50787a5028b73dd32e0c7dce
SHA17205d5c3d7efbc5805eb0b343a1bc83903e7589c
SHA25600956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3
SHA512ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8