Analysis
- user interaction
yes - max time kernel
13s - max time network
17s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 17:40
General
- Target XWormClient.exe
- Size 145KB
- Sample260905-v855tsyhrd
- SHA256 f2b2571ae07c8fe7a357c612b3fece9d766b21e8d10b1f337851e2e6d178c48c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_t0nbiq2z.ofl.ps1
svchost.exe
memory/4132-18-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-20-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-7-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-10-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-11-0x0000011B52FB0000-0x0000011B52FD2000-memory.dmp
memory/4132-12-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-13-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-14-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-16-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-15-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-17-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-29-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-19-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-6-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-23-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4132-24-0x0000011B53160000-0x0000011B5317E000-memory.dmp
memory/4132-25-0x0000011B53410000-0x0000011B534C2000-memory.dmp
memory/4132-26-0x0000011B53020000-0x0000011B5302A000-memory.dmp
memory/4132-27-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-0-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp
memory/4912-5-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-4-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-3-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-39-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-2-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-53-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/4912-1-0x0000000000830000-0x000000000085A000-memory.dmp