Overview

overview

10

Static

static

3

injection.exe

windows11-21h2-x64

Analysis

  • max time kernel
    82s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-01-2025 14:38

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    injection.exe

  • Size

    261KB

  • MD5

    c78e05dfbaa9546f231cd5ac573fd85b

  • SHA1

    0d0fa2c72a59260218c17c08f65c565bc0253b75

  • SHA256

    0ef75cb1e91b60d4b85acf17658cc069e47c9fa877d4e09103ec318e01b05952

  • SHA512

    a8cbe52f5cc2f0758d9398eed59bc6b8f493c283433619f359cc078491830cb64cb0da576a0e43b8906e2aa335968ae0420891d40c506ea8491a5889be6e0d5e

  • SSDEEP

    3072:BoGe4NJ1ixKuPW+xq9HucxtX/BOKk6gMEHBAnpK37nXv8g00ZQ7j3Pss74tyJhWV:bNTiUEq9HucBRDg18o43PdDNxgV5

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

trip-thesaurus.gl.at.ply.gg:16715

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\injection.exe
    "C:\Users\Admin\AppData\Local\Temp\injection.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4492
  • C:\Users\Admin\AppData\Roaming\SearchApp.exe
    C:\Users\Admin\AppData\Roaming\SearchApp.exe
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1392
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4276
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:248
    • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      1a9fa92a4f2e2ec9e244d43a6a4f8fb9

      SHA1

      9910190edfaccece1dfcc1d92e357772f5dae8f7

      SHA256

      0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

      SHA512

      5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      df808b11175970c23f00e611a7b6d2cc

      SHA1

      0243f099e483fcafb6838c0055982e65634b6db6

      SHA256

      2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

      SHA512

      c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      b0a85f07903eaad4aace8865ff28679f

      SHA1

      caa147464cf2e31bf9b482c3ba3c5c71951566d1

      SHA256

      c85c7915e0bcc6cc3d7dd2f6b9d9e4f9a3cf0ccefa043b1c500facac8428bfd5

      SHA512

      7a650a74a049e71b748f60614723de2b9d2385a0f404606bcb22ae807e22a74c53cf672df9e7a23605dfff37865443a5899eafea323134a818eb59c96e0f94bd

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      4914eb0b2ff51bfa48484b5cc8454218

      SHA1

      6a7c3e36ce53b42497884d4c4a3bda438dd4374b

      SHA256

      7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e

      SHA512

      83ab35f622f4a5040ca5cb615a30f83bb0741449225f1fd1815b6923e225c28241d0c02d34f83f743349a5e57f84ca1c6f44016797a93d5985be41d11be79500

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      80b42fe4c6cf64624e6c31e5d7f2d3b3

      SHA1

      1f93e7dd83b86cb900810b7e3e43797868bf7d93

      SHA256

      ee20a5b38a6674366efda276dbbf0b43eb54efd282acfc1033042f6b53a80d4d

      SHA512

      83c1c744c15a8b427a1d3af677ec3bfd0353875a60fe886c41570981e17467ebbb59619b960ca8c5c3ab1430946b0633ea200b7e7d84ab6dca88b60c50055573

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eo21lwyb.pou.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk
      Filesize

      819B

      MD5

      76f02ddf1b0651bbe59a17bbd681cfc7

      SHA1

      f49bcb39efc6bec36f146610081c42a712617ce4

      SHA256

      bdd65a94c0e8108b0186d87da69b6cc7cb56ba535ed57e9976bb68b8c8fcabf0

      SHA512

      b169fc13597ded3e24eb0543e8f4f57299fa5608bda7cabc43b104d481c3eab7fec079261f26f4d85c7ef484fc75a373721911f4604a03d978720af48f9d2fd0

      Download Submit

    • C:\Users\Admin\AppData\Roaming\SearchApp.exe
      Filesize

      261KB

      MD5

      c78e05dfbaa9546f231cd5ac573fd85b

      SHA1

      0d0fa2c72a59260218c17c08f65c565bc0253b75

      SHA256

      0ef75cb1e91b60d4b85acf17658cc069e47c9fa877d4e09103ec318e01b05952

      SHA512

      a8cbe52f5cc2f0758d9398eed59bc6b8f493c283433619f359cc078491830cb64cb0da576a0e43b8906e2aa335968ae0420891d40c506ea8491a5889be6e0d5e

      Download Submit

    • memory/1036-31-0x00007FF88ED30000-0x00007FF88F7F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1036-29-0x00007FF88ED30000-0x00007FF88F7F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1036-1-0x0000000000A80000-0x0000000000AC8000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1036-0-0x00007FF88ED33000-0x00007FF88ED35000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3112-12-0x00007FF88ED30000-0x00007FF88F7F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3112-10-0x00000240759D0000-0x00000240759F2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3112-15-0x00007FF88ED30000-0x00007FF88F7F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3112-11-0x00007FF88ED30000-0x00007FF88F7F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3556-34-0x00000000008B0000-0x00000000008C8000-memory.dmp

      Filesize

      96KB

      Download

    • memory/3556-93-0x000000001AE20000-0x000000001AE2C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4276-80-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-84-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-90-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-89-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-88-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-87-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-86-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-85-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-79-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-78-0x0000013DC8F60000-0x0000013DC8F61000-memory.dmp

      Filesize

      4KB

      Download