Analysis
-
max time kernel
1798s -
max time network
1800s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 17:20
Static task
static1
Behavioral task
behavioral1
Sample
true.exe
Resource
win7-20231129-en
General
-
Target
true.exe
-
Size
330KB
-
MD5
9c7e29c46aeea4af73bf5382f1b0bcf4
-
SHA1
2568ab3b2dd12fdfa9e4b2cd788b97106df1071e
-
SHA256
8599a5c62399e298ef5b855dc06d1163e3baaf8599520826af516c8ffd53bfb1
-
SHA512
1cc7f710b203f03ab64ef563eb3093ccb2e2c8beb5ea565e153fed5093e3a0583c525b06b9a1154f31ebaaf848d1f575f7c5738b5d8b6ff44d3c544a0eb8bb81
-
SSDEEP
3072:9sBTZQFLWx8MzI4IXoSuF/q9Q50t1YAQHmxqHd4HtMUsFTAG5bM:9sLQUxTI4IXo3F9GIGM2H2Us
Malware Config
Extracted
xworm
5.0
Signatures
-
An infostealer written in Python and packaged with PyInstaller. 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\microsoft.py crealstealer -
Detect Xworm Payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\XClient.exe family_xworm behavioral1/memory/2744-16-0x0000000000BC0000-0x0000000000BD0000-memory.dmp family_xworm behavioral1/memory/2108-97-0x0000000000230000-0x0000000000240000-memory.dmp family_xworm behavioral1/memory/1588-104-0x0000000000DA0000-0x0000000000DB0000-memory.dmp family_xworm behavioral1/memory/700-114-0x0000000000E80000-0x0000000000E90000-memory.dmp family_xworm behavioral1/memory/2268-121-0x00000000010E0000-0x00000000010F0000-memory.dmp family_xworm behavioral1/memory/808-131-0x0000000001120000-0x0000000001130000-memory.dmp family_xworm -
crealstealer
An infostealer written in Python and packaged with PyInstaller.
-
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk XClient.exe -
Executes dropped EXE 31 IoCs
Processes:
XClient.exeepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherpid process 2744 XClient.exe 2108 epicgameslauncher 1588 epicgameslauncher 2184 epicgameslauncher 1900 epicgameslauncher 700 epicgameslauncher 2836 epicgameslauncher 2268 epicgameslauncher 1572 epicgameslauncher 3048 epicgameslauncher 808 epicgameslauncher 1168 epicgameslauncher 2120 epicgameslauncher 948 epicgameslauncher 2964 epicgameslauncher 1892 epicgameslauncher 2428 epicgameslauncher 1736 epicgameslauncher 2604 epicgameslauncher 2756 epicgameslauncher 824 epicgameslauncher 1188 epicgameslauncher 1276 epicgameslauncher 3060 epicgameslauncher 1828 epicgameslauncher 2680 epicgameslauncher 2992 epicgameslauncher 2356 epicgameslauncher 1960 epicgameslauncher 2448 epicgameslauncher 2760 epicgameslauncher -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher" XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 944 powershell.exe 1448 powershell.exe 1088 powershell.exe 2000 powershell.exe 2744 XClient.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2520 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
XClient.exepowershell.exepowershell.exepowershell.exepowershell.exeepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherepicgameslauncherdescription pid process Token: SeDebugPrivilege 2744 XClient.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeDebugPrivilege 1448 powershell.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeDebugPrivilege 2744 XClient.exe Token: SeDebugPrivilege 2108 epicgameslauncher Token: SeDebugPrivilege 1588 epicgameslauncher Token: SeDebugPrivilege 2184 epicgameslauncher Token: SeDebugPrivilege 1900 epicgameslauncher Token: SeDebugPrivilege 700 epicgameslauncher Token: SeDebugPrivilege 2836 epicgameslauncher Token: SeDebugPrivilege 2268 epicgameslauncher Token: SeDebugPrivilege 1572 epicgameslauncher Token: SeDebugPrivilege 3048 epicgameslauncher Token: SeDebugPrivilege 808 epicgameslauncher Token: SeDebugPrivilege 1168 epicgameslauncher Token: SeDebugPrivilege 948 epicgameslauncher Token: SeDebugPrivilege 2964 epicgameslauncher Token: SeDebugPrivilege 1892 epicgameslauncher Token: SeDebugPrivilege 2428 epicgameslauncher Token: SeDebugPrivilege 1736 epicgameslauncher Token: SeDebugPrivilege 2604 epicgameslauncher Token: SeDebugPrivilege 2756 epicgameslauncher Token: SeDebugPrivilege 824 epicgameslauncher Token: SeDebugPrivilege 1188 epicgameslauncher Token: SeDebugPrivilege 1276 epicgameslauncher Token: SeDebugPrivilege 3060 epicgameslauncher Token: SeDebugPrivilege 1828 epicgameslauncher Token: SeDebugPrivilege 2680 epicgameslauncher Token: SeDebugPrivilege 2992 epicgameslauncher Token: SeDebugPrivilege 2356 epicgameslauncher Token: SeDebugPrivilege 1960 epicgameslauncher Token: SeDebugPrivilege 2448 epicgameslauncher Token: SeDebugPrivilege 2760 epicgameslauncher -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exeXClient.exepid process 2520 AcroRd32.exe 2520 AcroRd32.exe 2744 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
true.execmd.exerundll32.exeXClient.exetaskeng.exedescription pid process target process PID 2216 wrote to memory of 2744 2216 true.exe XClient.exe PID 2216 wrote to memory of 2744 2216 true.exe XClient.exe PID 2216 wrote to memory of 2744 2216 true.exe XClient.exe PID 2216 wrote to memory of 1980 2216 true.exe cmd.exe PID 2216 wrote to memory of 1980 2216 true.exe cmd.exe PID 2216 wrote to memory of 1980 2216 true.exe cmd.exe PID 2216 wrote to memory of 2556 2216 true.exe rundll32.exe PID 2216 wrote to memory of 2556 2216 true.exe rundll32.exe PID 2216 wrote to memory of 2556 2216 true.exe rundll32.exe PID 1980 wrote to memory of 2668 1980 cmd.exe chcp.com PID 1980 wrote to memory of 2668 1980 cmd.exe chcp.com PID 1980 wrote to memory of 2668 1980 cmd.exe chcp.com PID 2556 wrote to memory of 2520 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2520 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2520 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2520 2556 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 944 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 944 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 944 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1448 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1448 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1448 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1088 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1088 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1088 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 2000 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 2000 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 2000 2744 XClient.exe powershell.exe PID 2744 wrote to memory of 1636 2744 XClient.exe schtasks.exe PID 2744 wrote to memory of 1636 2744 XClient.exe schtasks.exe PID 2744 wrote to memory of 1636 2744 XClient.exe schtasks.exe PID 1128 wrote to memory of 2108 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2108 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2108 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1588 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1588 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1588 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2184 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2184 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2184 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1900 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1900 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1900 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 700 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 700 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 700 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2836 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2836 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2836 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2268 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2268 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 2268 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1572 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1572 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1572 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 3048 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 3048 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 3048 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 808 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 808 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 808 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1168 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1168 1128 taskeng.exe epicgameslauncher PID 1128 wrote to memory of 1168 1128 taskeng.exe epicgameslauncher -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\true.exe"C:\Users\Admin\AppData\Local\Temp\true.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2668
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\microsoft.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\microsoft.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"3⤵
- Creates scheduled task(s)
PID:1636
-
C:\Windows\system32\taskeng.exetaskeng.exe {5A14F544-2FD4-4544-BC3E-4FADAF7763F0} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:700 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1168 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Users\Admin\AppData\Roaming\epicgameslauncherC:\Users\Admin\AppData\Roaming\epicgameslauncher2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e729cac65377789ee5a5174e5ee1f781
SHA1d645f2229eb85ef96bd313be4b2c10389d36f349
SHA256701d43e610ff90d31bf38ccf78e773dc1ef5c080fb0679be1404484dac0ad872
SHA51253d1645088a386ad59e75468517fcab922fd44e74904f86f6ae1cabd593e6936170558b54c69ad323a2ead980627fd7c5a613567523f6918e49ddc4b86f4dace
-
Filesize
5KB
MD5ac876bbb38218601fd9b705fcd55cb51
SHA169cfba3eeabec0e03ddda6ae5f2533acbfa94685
SHA2564895833c82a991b73d5d7cf0e73ffcb4159d6fbcd21ac98681002f03469ff086
SHA512807fce9a386a62da7d84138cb1f94236f17cead5cf3825f7a8f8e38aa40722b38475c26d3b7930d2031701958d46777f3bbd41136bbfb8ae2045c23c650575eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD58921a1bfd21c28d9c54bb878d934edcb
SHA1db89ea6c286e8d6b26d068cb0299b9fb4603fe8d
SHA256f3c6397003a5b06efac7cc26eb88aba200929c25d08221c75ecdcba100f403a5
SHA512d0cf8a9ffd371bddd618a8980b94c50b3409afec9ebc1d2d237737297990081bdf69d00589ce023d0d3161d5f2280c31f9acd1a07eb6c6f6b0ecbc56344a8e04
-
Filesize
41KB
MD58bc14b0327de65a2f2296686eb3f3fe2
SHA13a4ae540a7c5f79aafb28968a72764f50043c5f9
SHA256e6a420464f7c877c5421d7b336705a19609161f84560711e441b2ab48bb54abf
SHA512ec1156de64c29f818c5b2a243f7ab8fd0beab5975b0ceaa7b81514a9be7d6c30211a8cd325655387ffe33bfb0b824fa30e14987e61301bf63ad2d532fc9a016c
-
Filesize
78KB
MD556858a6f2411a10b07e553dafc76f2cc
SHA151fde952fd7ac4a4ad5afe00ee77116120c1f60b
SHA256ad2c20dc31883ca97884043544fe004cc370270be97ba1bf447b9358c4bd5f92
SHA51262e529809f42460bd13752fa97c0fc6a19b33e82d8350be10d187e336638d1abf12325ebba79535d22d6666d97698a234d0dcc86c542f97bcf80d34b403676cb
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e