Threat behavior
XWorm performs several actions to maintain control over the compromised device and extract information.
The malware creates the following files:
- C:\Users\<USER>\AppData\Local\WordGenius Technologies\SwiftWrite.pif
- C:\Users\<USER>\AppData\Local\WordGenius Technologies\SwiftWrite.js
- C:\Users\Public\jsc.exe
- C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
- C:\Users\Public\ProfileDetails.ps1
- C:\Users\Public\Details.au3
- C:\Windows\system32\catroot
It sets the following registries:
- HKEY_USERS\S-1-5-21-<SID>\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
It also creates the following processes:
- C:\Users\Public\InformationCheck.exe
- C:\Users\Public\Details.au3
- cmd /k echo [InternetShortcut] > "...Startup\SwiftWrite.url" & echo URL="...SwiftWrite.js" >> "...Startup\SwiftWrite.url" & exit
- C:\Users\Public\jsc.exe
- "C:\Users\<USER>\Desktop\akt.exe"
- powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
It also communicates to the following hosts:
- 192.3.182.92:7006 (malicious)
- kribyrisk.com (malicious)
The malware accesses or downloads from following URLs:
- hxxps://api.telegram.org:443
- hxxps://kribyrisk[.]com:443/b/iyyeOkT.txt
- hxxps://kribyrisk[.]com/b/iyyeOkT.txt
Prevention
Guidance for Individual users
Keep your operating system and antivirus products up to date. Customers who have turned on automatic updates do not need to take additional action
Take these steps to help prevent malware infection on your computer.
Guidance for enterprise administrators and Microsoft 365 Defender customers
Ransomware more than often attacks enterprises than individuals. Following the below mitigation stepTake these steps to help prevent malware infection on your computers can help prevent ransomware attacks.
Microsoft recommends the following mitigations to reduce the impact of activity:
- Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown variants.
- Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
- Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.
- Use Microsoft Defender for Office 365 for enhanced phishing protection and coverage against new threats and polymorphic variants. Defender for Office 365 customers should ensure that Safe Attachments and Safe Links protection is enabled for users with Zero-hour Auto Purge (ZAP) to remove emails when a URL gets weaponized post-delivery.
- Microsoft 365 Defender customers can turn on attack surface reduction rules to prevent common attack techniques used in ransomware attacks:
- Block process creations originating from PsExec and WMI commands – Some organizations might experience compatibility issues with this rule on certain server systems but should deploy it to other systems to prevent lateral movement originating from PsExec and WMI, including Impacket’s WMIexec.
- Block executable files from running unless they meet a prevalence, age, or trusted list criterion
- Use advanced protection against ransomware
- Block all Office applications from creating child processes.
