xworm | 544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MsWinSvcUpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MsWinSvc.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MsWinSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	MsWinSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	MsWinSvcUpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MsWinSvcUpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MsWinSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	MsWinSvcUpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MsWinSvcUpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	MsWinSvcUpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	MsWinSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	MsWinSvc.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	MsDefSvc.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmt.lnk	svc32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmt.lnk	svc32.exe

Executes dropped EXE 9 IoCs

pid	Process
4912	MsDefSvc.exe
2184	MsWinSvcUpd.exe
2932	MsWinSvc.exe
1368	K7RKScan.sys
4280	mswsvc.exe
5032	svc32.exe
1040	cmt.exe
3656	cmt.exe
3244	mswsvc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftDefenderSvc = "C:\\ProgramData\\Microsoft\\Windows\\MsDefSvc.exe"	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftDefenderSvc = "C:\\ProgramData\\Microsoft\\Windows\\MsDefSvc.exe"	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftDefenderSvc = "C:\\ProgramData\\Microsoft\\Windows\\MsDefSvc.exe"	MsDefSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftDefenderSvc = "C:\\ProgramData\\Microsoft\\Windows\\MsDefSvc.exe"	MsDefSvc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
19	raw.githubusercontent.com
3	discord.com
13	raw.githubusercontent.com
27	discord.com
1	discord.com
2	discord.com
11	raw.githubusercontent.com
12	discord.com
24	discord.com
1	raw.githubusercontent.com
4	discord.com
8	raw.githubusercontent.com
37	raw.githubusercontent.com
42	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\MsWinSvc.exe	MsWinSvcUpd.exe
File created	C:\Windows\System32\MsWinSvc.exe	MsWinSvcUpd.exe
File opened for modification	C:\Windows\System32\MsWinSvc.exe	MsWinSvc.exe
File created	C:\Windows\System32\MsWinSvc.exe	MsWinSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mswsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1276	schtasks.exe
4892	schtasks.exe
4404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
4912	MsDefSvc.exe
4912	MsDefSvc.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
2184	MsWinSvcUpd.exe
5032	svc32.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe
2932	MsWinSvc.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
4912	MsDefSvc.exe
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Token: SeLoadDriverPrivilege	4912	MsDefSvc.exe
Token: SeTcbPrivilege	3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Token: SeDebugPrivilege	2184	MsWinSvcUpd.exe
Token: SeTcbPrivilege	2184	MsWinSvcUpd.exe
Token: SeDebugPrivilege	5032	svc32.exe
Token: SeDebugPrivilege	5032	svc32.exe
Token: SeDebugPrivilege	1040	cmt.exe
Token: SeDebugPrivilege	2932	MsWinSvc.exe
Token: SeDebugPrivilege	3656	cmt.exe
Token: SeTcbPrivilege	2932	MsWinSvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	svc32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2184	3168	x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe	86
PID 2184 wrote to memory of 4404	2184	MsWinSvcUpd.exe	87
PID 2184 wrote to memory of 4280	2184	MsWinSvcUpd.exe	93
PID 4280 wrote to memory of 5032	4280	mswsvc.exe	94
PID 5032 wrote to memory of 1276	5032	svc32.exe	95
PID 2932 wrote to memory of 4892	2932	MsWinSvc.exe	100
PID 2932 wrote to memory of 3244	2932	MsWinSvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
"C:\Users\Admin\AppData\Local\Temp\x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe"
1⤵
- Sets service image path in registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\MsWinSvcUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\MsWinSvcUpd.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "MsWinSvcUpd" /tr "C:\Windows\System32\MsWinSvc.exe" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\mswsvc.exe
    "C:\Users\Admin\AppData\Local\Temp\\mswsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\svc32.exe
      "C:\Users\Admin\AppData\Local\Temp\svc32.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmt" /tr "C:\Users\Admin\AppData\Roaming\cmt.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1276

C:\ProgramData\Microsoft\Windows\MsDefSvc.exe
C:\ProgramData\Microsoft\Windows\MsDefSvc.exe
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\System32\MsWinSvc.exe
C:\Windows\System32\MsWinSvc.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\schtasks.exe
  schtasks /create /tn "MsWinSvcUpd" /tr "C:\Windows\System32\MsWinSvc.exe" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\mswsvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\mswsvc.exe"
  2⤵
  - Executes dropped EXE
  PID:3244

C:\Users\Admin\AppData\Local\Temp\K7RKScan.sys
C:\Users\Admin\AppData\Local\Temp\\K7RKScan.sys
1⤵
- Executes dropped EXE
PID:1368

C:\Users\Admin\AppData\Roaming\cmt.exe
C:\Users\Admin\AppData\Roaming\cmt.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Users\Admin\AppData\Roaming\cmt.exe
C:\Users\Admin\AppData\Roaming\cmt.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry