Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06/03/2025, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
SystemSettings.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
General
-
Target
SystemSettings.exe
-
Size
332KB
-
MD5
701a94f53d54d38a11f4e60bc4f95b18
-
SHA1
7413f5e4fc73eaf07d9d6cd67fc88fd40b70d9d0
-
SHA256
9233d5872258aa674b015b57a4f37ca43a22524a682382cd88969cef135dacdb
-
SHA512
4d63f155adbc5271fc82a263c4df29566ffbabb512ad2a7c73736969b29760bc0ae86e58f396907b8afa8791e8a8b042c895f94126a00da8c0b050e7ef343440
-
SSDEEP
6144:6qXq7egSKNNO3BLZsgd8+f0Pn95maRWFjt:6qapSKNNOpZsgdQbmamjt
Malware Config
Extracted
xworm
5.0
uoqo0jDHykn623lG
-
Install_directory
%Public%
-
install_file
SystemSettings.exe
-
pastebin_url
https://pastebin.com/raw/4zaiEtZS
-
telegram
https://api.telegram.org/bot8175192176:AAHZuZ0-rHS66YSwsvh8-gQjbZYSbY3IyXo/sendMessage?chat_id=7537927256
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2052-39-0x0000000002510000-0x000000000252E000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3384 powershell.exe 1168 powershell.exe 4520 powershell.exe 516 powershell.exe 4736 powershell.exe 2276 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation SystemSettings.exe Key value queried \REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation SystemSettings.exe -
Executes dropped EXE 1 IoCs
pid Process 2052 SystemSettings.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 41 IoCs
flow ioc 66 pastebin.com 69 pastebin.com 34 pastebin.com 36 pastebin.com 49 pastebin.com 81 pastebin.com 52 pastebin.com 68 pastebin.com 74 pastebin.com 85 pastebin.com 86 pastebin.com 39 pastebin.com 61 pastebin.com 75 pastebin.com 77 pastebin.com 84 pastebin.com 35 pastebin.com 51 pastebin.com 54 pastebin.com 55 pastebin.com 57 pastebin.com 78 pastebin.com 72 pastebin.com 23 pastebin.com 32 pastebin.com 48 pastebin.com 60 pastebin.com 65 pastebin.com 83 pastebin.com 87 pastebin.com 53 pastebin.com 76 pastebin.com 82 pastebin.com 50 pastebin.com 24 pastebin.com 56 pastebin.com 62 pastebin.com 80 pastebin.com 64 pastebin.com 67 pastebin.com 79 pastebin.com -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\System32\SystemSettings.exe SystemSettings.exe File opened for modification C:\Windows\System32\SystemSettings.exe SystemSettings.exe File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1184 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 powershell.exe 2276 powershell.exe 3384 powershell.exe 3384 powershell.exe 1168 powershell.exe 1168 powershell.exe 1168 powershell.exe 4520 powershell.exe 4520 powershell.exe 4520 powershell.exe 516 powershell.exe 516 powershell.exe 516 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe 2052 SystemSettings.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1252 SystemSettings.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeIncreaseQuotaPrivilege 2276 powershell.exe Token: SeSecurityPrivilege 2276 powershell.exe Token: SeTakeOwnershipPrivilege 2276 powershell.exe Token: SeLoadDriverPrivilege 2276 powershell.exe Token: SeSystemProfilePrivilege 2276 powershell.exe Token: SeSystemtimePrivilege 2276 powershell.exe Token: SeProfSingleProcessPrivilege 2276 powershell.exe Token: SeIncBasePriorityPrivilege 2276 powershell.exe Token: SeCreatePagefilePrivilege 2276 powershell.exe Token: SeBackupPrivilege 2276 powershell.exe Token: SeRestorePrivilege 2276 powershell.exe Token: SeShutdownPrivilege 2276 powershell.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeSystemEnvironmentPrivilege 2276 powershell.exe Token: SeRemoteShutdownPrivilege 2276 powershell.exe Token: SeUndockPrivilege 2276 powershell.exe Token: SeManageVolumePrivilege 2276 powershell.exe Token: 33 2276 powershell.exe Token: 34 2276 powershell.exe Token: 35 2276 powershell.exe Token: 36 2276 powershell.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeIncreaseQuotaPrivilege 3384 powershell.exe Token: SeSecurityPrivilege 3384 powershell.exe Token: SeTakeOwnershipPrivilege 3384 powershell.exe Token: SeLoadDriverPrivilege 3384 powershell.exe Token: SeSystemProfilePrivilege 3384 powershell.exe Token: SeSystemtimePrivilege 3384 powershell.exe Token: SeProfSingleProcessPrivilege 3384 powershell.exe Token: SeIncBasePriorityPrivilege 3384 powershell.exe Token: SeCreatePagefilePrivilege 3384 powershell.exe Token: SeBackupPrivilege 3384 powershell.exe Token: SeRestorePrivilege 3384 powershell.exe Token: SeShutdownPrivilege 3384 powershell.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeSystemEnvironmentPrivilege 3384 powershell.exe Token: SeRemoteShutdownPrivilege 3384 powershell.exe Token: SeUndockPrivilege 3384 powershell.exe Token: SeManageVolumePrivilege 3384 powershell.exe Token: 33 3384 powershell.exe Token: 34 3384 powershell.exe Token: 35 3384 powershell.exe Token: 36 3384 powershell.exe Token: SeDebugPrivilege 2052 SystemSettings.exe Token: SeDebugPrivilege 2052 SystemSettings.exe Token: SeDebugPrivilege 1168 powershell.exe Token: SeIncreaseQuotaPrivilege 1168 powershell.exe Token: SeSecurityPrivilege 1168 powershell.exe Token: SeTakeOwnershipPrivilege 1168 powershell.exe Token: SeLoadDriverPrivilege 1168 powershell.exe Token: SeSystemProfilePrivilege 1168 powershell.exe Token: SeSystemtimePrivilege 1168 powershell.exe Token: SeProfSingleProcessPrivilege 1168 powershell.exe Token: SeIncBasePriorityPrivilege 1168 powershell.exe Token: SeCreatePagefilePrivilege 1168 powershell.exe Token: SeBackupPrivilege 1168 powershell.exe Token: SeRestorePrivilege 1168 powershell.exe Token: SeShutdownPrivilege 1168 powershell.exe Token: SeDebugPrivilege 1168 powershell.exe Token: SeSystemEnvironmentPrivilege 1168 powershell.exe Token: SeRemoteShutdownPrivilege 1168 powershell.exe Token: SeUndockPrivilege 1168 powershell.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3100 mmc.exe 3100 mmc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2276 1252 SystemSettings.exe 84 PID 1252 wrote to memory of 2276 1252 SystemSettings.exe 84 PID 1252 wrote to memory of 3384 1252 SystemSettings.exe 87 PID 1252 wrote to memory of 3384 1252 SystemSettings.exe 87 PID 2052 wrote to memory of 1168 2052 SystemSettings.exe 100 PID 2052 wrote to memory of 1168 2052 SystemSettings.exe 100 PID 2052 wrote to memory of 4520 2052 SystemSettings.exe 102 PID 2052 wrote to memory of 4520 2052 SystemSettings.exe 102 PID 2052 wrote to memory of 516 2052 SystemSettings.exe 104 PID 2052 wrote to memory of 516 2052 SystemSettings.exe 104 PID 2052 wrote to memory of 4736 2052 SystemSettings.exe 107 PID 2052 wrote to memory of 4736 2052 SystemSettings.exe 107 PID 2052 wrote to memory of 1184 2052 SystemSettings.exe 111 PID 2052 wrote to memory of 1184 2052 SystemSettings.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SystemSettings.exe"C:\Users\Admin\AppData\Local\Temp\SystemSettings.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\System32\SystemSettings.exe"C:\Windows\System32\SystemSettings.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemSettings.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SystemSettings" /tr "C:\Users\Public\SystemSettings.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1184
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵PID:2648
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3100
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ebec742e1cbb74325a031bc4d3098d4a
SHA147dcd96d01fdba6128f12a98c2a0e5982fd33cfc
SHA2564443a8e14d18d1c03b865eabfca6787ac6c523c1edef61809341a680c26b7080
SHA51253480bad0abf1cb1389f25e9f01c133e3bdabf68254d98a83b722cd3523b4b95c0e38292e51be90e0860481462c805138b29a1d77d899401fa836e346d5f9dcf
-
Filesize
3KB
MD53eb3833f769dd890afc295b977eab4b4
SHA1e857649b037939602c72ad003e5d3698695f436f
SHA256c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
SHA512c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
-
Filesize
1KB
MD5f0f59cccd39a3694e0e6dfd44d0fa76d
SHA1fccd7911d463041e1168431df8823e4c4ea387c1
SHA25670466c7f3a911368d653396fdd68f993322c69e1797b492ca00f8be34b7f3401
SHA5125c726e1e28cb9c0c3ab963fbfbf471c6033839f3e535a3811581fdaa4da17175e5a8a8be84a4fccd99b81e048058e51d230ff3836e3ec920057a1b1676110bee
-
Filesize
1KB
MD5be2ae72d79212963660019816bfb136f
SHA138b5416596063187785205e49585060163b6b078
SHA2565daf94c9372343a2b1f524c44dd87863817011e1538bc56e2771e7f29ab81dcc
SHA512f8e89bc7aa2f5afd246bb8cb5433033421cefb43a1949f3544c7778ed674cb9aa1f92227543afa2f364cf66b04c0855a9d1c85eb89cfba4ba112cff9c5c62297
-
Filesize
1KB
MD5517975ca7c83e8fcb5361ca5fc19e616
SHA1593cf616c80c62f705505178166b07292739aeab
SHA256841ec881828b64f21782f476cd17b58ac01eaa1910b95a9c7e58eb5780c74439
SHA5122b711b28bec133ae40004c19597449625e87f2a5cce22569bb78f5d21e18c7bb873351371c1575ba8ea890caafa77ce9143d4237a46bdc606bbbd2a42be9a908
-
Filesize
1KB
MD5548f94fff5d24bde2d40f75b3174b9a8
SHA1c55523794628e2e8c70ed6787c9a7e5fb2ff21b1
SHA256d444f8a512e28eb1f2baa3231771b971030ffa940211b26c4a0c54f1b2053c46
SHA512f6167facf286d204820c00a81b36d3da3143318233fa2ecebecabd934b1eca68443fe4ea09341ccc7c3c73b0986328909a86df23a807bc7f7d816c1b9114f4ae
-
Filesize
1KB
MD52c29e0b132bc937ab311fb9ddec7e398
SHA1d6fcfc55694bf40152877dca255fdf7086a4f38a
SHA256a99bb45c15e7b13de98561fdae201b18b46b0d19731cc117f1428196d6016b0e
SHA5127d5413eb70984a074c7d66cb3d5ab838dea7179aa84d9369036cdfcbc26afb78d9fb315fda9dfeb3e91e7e1fdb969689e3f48ecaa0e22eab42c2dbdf0182f741
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
332KB
MD5701a94f53d54d38a11f4e60bc4f95b18
SHA17413f5e4fc73eaf07d9d6cd67fc88fd40b70d9d0
SHA2569233d5872258aa674b015b57a4f37ca43a22524a682382cd88969cef135dacdb
SHA5124d63f155adbc5271fc82a263c4df29566ffbabb512ad2a7c73736969b29760bc0ae86e58f396907b8afa8791e8a8b042c895f94126a00da8c0b050e7ef343440