Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 23:00
Behavioral task
behavioral1
Sample
666.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
General
-
Target
666.exe
-
Size
38KB
-
MD5
cd8809b75d773a8d0eccc53d726cc7f3
-
SHA1
e8d67db538e25248649a0d5e4628dd84593ad4ce
-
SHA256
f21c5c3efc4b19daebbc7e7d77ad1eb93fe888a90d85e4260eeb9e7ecaf208e9
-
SHA512
627afc3cc4a0c49e9a3a6a715eb5733bbbda735eb82df0bb19b9ee5cfe9c14e5c2933e95d67dc91cdd5a93b378eba67ff82fb73a8ae24af901526f128491650c
-
SSDEEP
768:jV+IESzfTv5EL5G7nSthO/i7FWP59W4OMhpaQkj:js7i5W5XqiFK9W4OMvO
Malware Config
Extracted
Family
xworm
Version
5.0
C2
joined-loaded.gl.at.ply.gg:35660
Mutex
1iUpZGo6HONV3B1a
Attributes
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3132-1-0x0000000000F70000-0x0000000000F80000-memory.dmp family_xworm behavioral2/files/0x000e000000023a73-23.dat family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 666.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 666.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3132 666.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3132 666.exe Token: SeDebugPrivilege 3132 666.exe Token: SeDebugPrivilege 1196 taskmgr.exe Token: SeSystemProfilePrivilege 1196 taskmgr.exe Token: SeCreateGlobalPrivilege 1196 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe 1196 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3132 666.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\666.exe"C:\Users\Admin\AppData\Local\Temp\666.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3132
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780B
MD5e8aaa61c49c6d858e10f7efc0f0abee2
SHA1deae7c7a5c1ba0bfcedb48143cffb51281ef2c53
SHA2564942fe48ec470b6250f97ca330995d37be6aeb30630253b0b43bf6d8c11043c8
SHA5123c095a4f1d1747449447d36c4e72adfca6262ca18c4ed9c5229ecd87a0a5c7b1905065f4258da22310398eea9bfd652f6fd3a022f64a8450107d0f7b2fa28232
-
Filesize
38KB
MD5cd8809b75d773a8d0eccc53d726cc7f3
SHA1e8d67db538e25248649a0d5e4628dd84593ad4ce
SHA256f21c5c3efc4b19daebbc7e7d77ad1eb93fe888a90d85e4260eeb9e7ecaf208e9
SHA512627afc3cc4a0c49e9a3a6a715eb5733bbbda735eb82df0bb19b9ee5cfe9c14e5c2933e95d67dc91cdd5a93b378eba67ff82fb73a8ae24af901526f128491650c