Analysis
- max time kernel
20s - max time network
15s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 07:58
Errors
General
- Target 0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe
- Size 2.9MB
- Sample260706-jvb42sfv3n
- SHA256 0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae
Malware Config
Extracted
-
xworm
-
uchiwa5.duckdns.org:8887
-
176.160.157.96:8887
-
incelcuck.duckdns.org:8887
-
Install_directory
%Temp%
-
install_file
jusched.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 4 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe"C:\Users\Admin\AppData\Local\Temp\0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jusched.exe"C:\Users\Admin\AppData\Local\Temp\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"3⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\System\System32.exeC:\ProgramData\System\System32.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
jusched.exe
miner.exe
update.exe
__PSScriptPolicyTest_e11jvk0l.qbo.ps1
memory/1508-43-0x000000001B180000-0x000000001B190000-memory.dmp
memory/1508-35-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-38-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-41-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-36-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-17-0x00000000004C0000-0x00000000004DC000-memory.dmp
memory/1508-34-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-44-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/1508-40-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/2096-66-0x0000027330C20000-0x0000027330CD2000-memory.dmp
memory/2404-56-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2404-57-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2404-55-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2404-54-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2876-37-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/2876-31-0x00000000009B0000-0x00000000009BA000-memory.dmp
memory/2876-33-0x0000000005410000-0x00000000054A2000-memory.dmp
memory/2876-42-0x0000000074472000-0x0000000074473000-memory.dmp
memory/2876-32-0x00000000059D0000-0x0000000005F8A000-memory.dmp
memory/4292-51-0x000002A3004E0000-0x000002A300592000-memory.dmp
memory/4292-50-0x000002A3004C0000-0x000002A3004DE000-memory.dmp
memory/4292-52-0x000002A367970000-0x000002A36797A000-memory.dmp
memory/4292-47-0x000002A37FEA0000-0x000002A37FEC2000-memory.dmp
memory/6076-0-0x00007FF89E5BF000-0x00007FF89E5C0000-memory.dmp
memory/6076-30-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/6076-18-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/6076-16-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/6076-3-0x00007FF89E430000-0x00007FF89EDD4000-memory.dmp
memory/6076-1-0x0000000000FF0000-0x00000000012E4000-memory.dmp