Analysis
- max time kernel
22s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 04:45
Errors
General
- Target 0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe
- Size 2.9MB
- Sample260831-fdpf9sef87
- SHA256 0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae
Malware Config
Extracted
-
xworm
-
uchiwa5.duckdns.org:8887
-
176.160.157.96:8887
-
incelcuck.duckdns.org:8887
-
Install_directory
%Temp%
-
install_file
jusched.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 4 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe"C:\Users\Admin\AppData\Local\Temp\0ccf91a42685f9d66f0a75fc2ccc9acccd0dc041d859542ea6d737f3cfe13bae.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jusched.exe"C:\Users\Admin\AppData\Local\Temp\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\System\System32.exeC:\ProgramData\System\System32.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
jusched.exe
miner.exe
update.exe
__PSScriptPolicyTest_om12lwmj.izf.ps1
memory/1284-39-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-41-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-43-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-42-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-40-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-12-0x0000000000600000-0x000000000061C000-memory.dmp
memory/1284-37-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-36-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1284-61-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/1696-69-0x000002281EC40000-0x000002281ECF2000-memory.dmp
memory/1984-52-0x0000024277770000-0x000002427778E000-memory.dmp
memory/1984-49-0x00000242776D0000-0x00000242776F2000-memory.dmp
memory/1984-53-0x00000242779F0000-0x0000024277AA2000-memory.dmp
memory/1984-54-0x0000024277790000-0x000002427779A000-memory.dmp
memory/2160-8-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2160-0-0x00007FFEC1C6F000-0x00007FFEC1C70000-memory.dmp
memory/2160-1-0x0000000000C80000-0x0000000000F74000-memory.dmp
memory/2160-19-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2160-13-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2160-3-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2160-31-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2160-32-0x00007FFEC1AE0000-0x00007FFEC2484000-memory.dmp
memory/2484-59-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2484-57-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2484-58-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2484-56-0x0000000140000000-0x000000014002B000-memory.dmp
memory/4408-44-0x0000000005770000-0x0000000005780000-memory.dmp
memory/4408-45-0x00000000743E2000-0x00000000743E3000-memory.dmp
memory/4408-38-0x00000000054E0000-0x00000000054EA000-memory.dmp
memory/4408-35-0x0000000005540000-0x00000000055D2000-memory.dmp
memory/4408-34-0x0000000005C40000-0x00000000061FA000-memory.dmp
memory/4408-33-0x0000000000B00000-0x0000000000B0A000-memory.dmp
memory/4408-71-0x00000000743E2000-0x00000000743E3000-memory.dmp
memory/4408-70-0x0000000005770000-0x0000000005780000-memory.dmp