Managed XDR

vtdl_1761812674_03eexwrq (XWorm) — malware analysis report

File info

Filename
vtdl_1761812674_03eexwrq
File type
CDFV2 Microsoft Outlook Message
File size
55.5 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
748f0c8c2cd0a81ef93c326fba0d8626fc0f09c2
SHA256
8956ea4584bbcb12ae27e1fef3b4be52bf7bad689465b3f57a406a21f88cdb70
MD5
ee6e55e2098a9df67765dc0782704b8d

Malwares

  • XWorm

Signatures

Execution

T1059 network_wscript_downloader: Wscript.exe initiated network communication
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1059.001 suspicious_process: Spawns a suspicious process
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler

Privilege Escalation

T1055.002 inject_write_pe: Writes PE file to another process's memory
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1055 injection_failed: The attempt to inject into a process has failed
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218 bypass_dev_utils: Executing .NET utility in a suspended state, potentially for injection
T1055.002 inject_write_pe: Writes PE file to another process's memory
T1497 debugs_self: Creates a process and debugs it
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1055 injection_failed: The attempt to inject into a process has failed
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497 debugs_self: Creates a process and debugs it
T1082 has_wmi: Executes one or several WMI requests
T1518.001 wmi_check_av: Uses WMI to check for installed antivirus software
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)

Command and Control

T1071 network_wscript_downloader: Wscript.exe initiated network communication
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Exfiltration

T1022 encrypts_pc_info: Collects and encrypts information about the computer (possibly for exfiltration)

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
code_share_services: Connects to text storage services (potentially for malicious payload delivery)
creates_exe: Creates executable files in the file system
network_powershell: Powershell process network connection detected
network_ftp: Performs FTP requests
no_graphical_activity: No graphic activity
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
suspicious_network_port: Performs TCP or UDP request to non-standard port
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk

Related reports