Analysis date (UTC): 11 January 2025, 21:57Analysis environment: Windows 10 Pro, build 19045, x64

/asafzss/XWORM-5.6/raw/refs/heads/main/XWorm%20V5.6.exe

MD5:F8A31A0A95B3839A31FD971DBB4633EF

SHA1:402E3B3FCDE07138AD518057715B8C1FC14F0029

SHA256:ADD19A9DB4730F41575FB951E9AEC6DCF35D8DB2CB94CBA896667881467E6FD5

Analysis result

Threat level:Malicious activity

Tags:

Full analysis:Analysis /asafzss/XWORM-5.6/raw/refs/heads/main/XWorm%20V5.6.exe (MD5: F8A31A0A95B3839A31FD971DBB4633EF) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Adds path to the Windows Defender exclusion list

SecurityHealthSystray.exe (PID: 6728)

Changes powershell execution policy (Bypass)

SecurityHealthSystray.exe (PID: 6728)

Bypass execution policy to execute commands

powershell.exe (PID: 7020)
powershell.exe (PID: 2612)
powershell.exe (PID: 6012)
powershell.exe (PID: 5592)

Adds process to the Windows Defender exclusion list

SecurityHealthSystray.exe (PID: 6728)

Changes the autorun value in the registry

SecurityHealthSystray.exe (PID: 6728)

Uses Task Scheduler to run other applications

SecurityHealthSystray.exe (PID: 6728)

Create files in the Startup directory

SecurityHealthSystray.exe (PID: 6728)

SUSPICIOUS

Reads security settings of Internet Explorer

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Reads the date of Windows installation

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Application launched itself

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)

Executable content was dropped or overwritten

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Process drops legitimate windows executable

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Starts a Microsoft application from unusual location

SecurityHealthSystray.exe (PID: 6728)

Reads the BIOS version

SecurityHealthSystray.exe (PID: 6728)

The process checks if it is being run in the virtual environment

SecurityHealthSystray.exe (PID: 6728)

Script adds exclusion path to Windows Defender

SecurityHealthSystray.exe (PID: 6728)

Starts POWERSHELL.EXE for commands execution

SecurityHealthSystray.exe (PID: 6728)

Read disk information to detect sandboxing environments

SecurityHealthSystray.exe (PID: 6728)

Script adds exclusion process to Windows Defender

SecurityHealthSystray.exe (PID: 6728)

Process communicates with Telegram (possibly using it as an attacker's C2 server)

SecurityHealthSystray.exe (PID: 6728)

Potential Corporate Privacy Violation

svchost.exe (PID: 2192)

Connects to unusual port

SecurityHealthSystray.exe (PID: 6728)

INFO

Reads the computer name

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)
SecurityHealthSystray.exe (PID: 6728)

Checks supported languages

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Process checks computer location settings

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Reads the machine GUID from the registry

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)

Create files in a temporary directory

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)

The process uses the downloaded file

8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 6460)
SecurityHealthSystray.exe (PID: 6728)
8d974012-b880-482f-a35f-68a0808a2e33.exe (PID: 2632)

Sends debugging messages

SecurityHealthSystray.exe (PID: 6728)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 7020)
powershell.exe (PID: 2612)
powershell.exe (PID: 5592)
powershell.exe (PID: 6012)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 7020)
powershell.exe (PID: 2612)
powershell.exe (PID: 5592)
powershell.exe (PID: 6012)

Reads Environment values

SecurityHealthSystray.exe (PID: 6728)

Creates files or folders in the user directory

SecurityHealthSystray.exe (PID: 6728)

Disables trace logs

SecurityHealthSystray.exe (PID: 6728)

Checks proxy server information

SecurityHealthSystray.exe (PID: 6728)

Reads the software policy settings

SecurityHealthSystray.exe (PID: 6728)

Attempting to use instant messaging service

SecurityHealthSystray.exe (PID: 6728)
svchost.exe (PID: 2192)

Threats

PID	Process	Class	Message
2192	svchost.exe	Potentially Bad Traffic	ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
2192	svchost.exe	Misc activity	ET HUNTING Telegram API Domain in DNS Lookup
6728	SecurityHealthSystray.exe	Misc activity	ET HUNTING Telegram API Certificate Observed
6728	SecurityHealthSystray.exe	Misc activity	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
2192	svchost.exe	Potential Corporate Privacy Violation	ET POLICY DNS Query to a Reverse Proxy Service Observed
2192	svchost.exe	Misc activity	ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)