Overview

overview

10

Static

static

3

WizWorm.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WizWorm.exe

  • Size

    14.4MB

  • MD5

    7b482bfebde8df6acddf6ade34bdc08c

  • SHA1

    bb8515e16d931d9482d0231adc1f6e15eb2fd3e2

  • SHA256

    2b60d620e823ec02ddc282697d4d9fb1f444463081f04fd06438a7bc96a9ef6a

  • SHA512

    66a1503cd25f8ffca00c0f13683116bdf53a99a41764715823a398da9777795ce64aa3160a32d39f424407648eaec3fc2637482a280994fa6477b53450e08b9d

  • SSDEEP

    393216:8b8KCaXxgAAtOdR7eHNhoTP81jIMCrSAPp14uKVQ2E0iQII/1:8b8KRXxqtHthoTlPpftQIs1

Score
10/10
xwormdefense_evasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

mailing-perception.gl.at.ply.gg:63145

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizWorm.exe
    "C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZQBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAagBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAdgBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAcgBhACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1900
    • C:\Windows\WizWorm.exe
      "C:\Windows\WizWorm.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:552
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "WizWorm" /tr "C:\ProgramData\WizWorm.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4980
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5116
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WizWorm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizWorm" /tr "C:\ProgramData\WizWorm.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3752
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3168
  • C:\ProgramData\WizWorm.exe
    C:\ProgramData\WizWorm.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:396
  • C:\ProgramData\WizWorm.exe
    C:\ProgramData\WizWorm.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WizWorm.exe.log
    Filesize

    1KB

    MD5

    3982d6d16fd43ae609fd495bb33433a2

    SHA1

    6c33cd681fdfd9a844a3128602455a768e348765

    SHA256

    9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

    SHA512

    4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    cf5f16a238159cf782efdf308b95696f

    SHA1

    33bd27e1d015556b21cae2e5c055ccae6fe4f42a

    SHA256

    31c335abca07196839c60cc6505919d9a16383ba3b3791786b55b97f2f7647c6

    SHA512

    8472522af9c73d71d715ed50dd55010fad4674f4418aa577f5e628ad4d93ea51758d1cabd2502a867515035e3547179a08363e15a0dbb5adbf3ca38008e8404e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    2e907f77659a6601fcc408274894da2e

    SHA1

    9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

    SHA256

    385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

    SHA512

    34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    1f8ac7ecec0193d6e152c3f10d070340

    SHA1

    945a8957d0c35c873bf16bf83b48928d4e09b82b

    SHA256

    f21d3bc031be1db415de1a6324660e5540bb7d8f4bdc75f22ba8ebb95643d044

    SHA512

    d3a469acc6f53976f8a61cb97da755e47aec35aee8f8c8bc12c9b95435567cb83dee0739662ef303e4a58d57f05c212f685a556d07e5bf7a13f794e800e8a7f2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    eb1ad317bd25b55b2bbdce8a28a74a94

    SHA1

    98a3978be4d10d62e7411946474579ee5bdc5ea6

    SHA256

    9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

    SHA512

    d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    60945d1a2e48da37d4ce8d9c56b6845a

    SHA1

    83e80a6acbeb44b68b0da00b139471f428a9d6c1

    SHA256

    314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

    SHA512

    5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5l3w5ba.os5.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizWorm.lnk
    Filesize

    670B

    MD5

    d4bad0645b94e2926e337e402be0625f

    SHA1

    75efa7a99e7c1471d0d23fd8357eb778b7178d88

    SHA256

    8bdd0950c6ae028e514d847b6ec5366f1869479e6f3c690c17722db868f7fc0d

    SHA512

    7b9f43a7cf61ed0ab09a07c05c0f36583a3dfa89dc1811ab5d8dff4683d3f1312f451f05d04565075c8e9f764f6537ddad588f2377ceda7b7a1fba727beaa943

    Download Submit

  • C:\Windows\WizWorm.exe
    Filesize

    100KB

    MD5

    314952857dbaa3f03c09355737b1d2c6

    SHA1

    2da8d4cceecdc52609f34ee6adf5876bcf6cea94

    SHA256

    4bfe2784c6339e3ec2bbed7c751f88106524516dde2bb249a29b0cc883ff6a34

    SHA512

    7dd9cb1152ea82a1e83f65b3e98071e30bdcb494f61362255d2301bcde227b9614548f182a179927be87c9b521f4e8295bc7a5ec78c4ca6132f38b445d0a839b

    Download Submit

  • memory/1900-27-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1900-29-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1900-32-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1900-22-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1900-21-0x000001922EBF0000-0x000001922EC12000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2332-14-0x0000000000F00000-0x0000000000F20000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2332-131-0x0000000002F90000-0x0000000002F9C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2332-120-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2332-105-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2332-15-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2332-82-0x000000001BD30000-0x000000001BD4A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2332-28-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2460-10-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2460-1-0x0000000000F70000-0x0000000001DEA000-memory.dmp

    Filesize

    14.5MB

    Download

  • memory/2460-33-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2460-0-0x00007FFBC48C3000-0x00007FFBC48C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3168-46-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-40-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-41-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-43-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-44-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-42-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-45-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-35-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-36-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3168-34-0x0000019D7B6B0000-0x0000019D7B6B1000-memory.dmp

    Filesize

    4KB

    Download