Malware Analysis Report

2024-09-11 08:54

Sample ID 240428-wgzz6sde3w
Target 8d2faf1c3a857566f516c28da34b9479.exe
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
Tags
xworm persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f

Threat Level: Known bad

The file 8d2faf1c3a857566f516c28da34b9479.exe was found to be: Known bad.

Malicious Activity Summary

xworm persistence rat trojan

Xworm

Detect Xworm Payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-28 17:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 17:54

Reported

2024-04-28 17:55

Platform

win7-20240221-en

Max time kernel

34s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 1932 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 1932 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 1932 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 1932 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 2152 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 1200 wrote to memory of 988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1200 wrote to memory of 988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1200 wrote to memory of 988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1200 wrote to memory of 988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC236.tmp"

C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8d2faf1c3a857566f516c28da34b9479.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {3480E7E0-4519-47E7-821E-7BF361B36382} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/1932-0-0x0000000000C30000-0x0000000000CD2000-memory.dmp

memory/1932-1-0x0000000073FF0000-0x00000000746DE000-memory.dmp

memory/1932-2-0x0000000006ED0000-0x0000000006F10000-memory.dmp

memory/1932-3-0x0000000000900000-0x0000000000920000-memory.dmp

memory/1932-4-0x0000000000930000-0x0000000000944000-memory.dmp

memory/1932-5-0x0000000004CC0000-0x0000000004D14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC236.tmp

MD5 ad692d7816ec7e34a919719cb3f38bfd
SHA1 15e701acc1277ae4319c7909b5260f9c25b714e1
SHA256 ed494fc94b57261d96b54ede8c9922fcba08fcf15a2d73ade95268e1f877afc3
SHA512 987dc3f8f4a0fcfb0590d6ca5a3076cda2d8c1e435b4480e57869a7d780199a5a30648f4238e5dbdfcc046c73d59ff0d9b5722b400e01a40be73fefd5fb08e78

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d0784a1f2a74d20a548bcdfe1618bc81
SHA1 3a85067e275138bfbb5efc4f81d68bcf463cf580
SHA256 3b672f35344dcb0c500475bcd5e0a44a1ecbdb726f5ae464e0cb91468e051770
SHA512 cdd936a737183e2c3bcf638a823b0ce2d54a9aba95774225269d0e143ca91cbe94653d07f830f323666b84958a13904b1608fa0771e0c62ffddfb0d7b6d96e8d

memory/2152-19-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-22-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-29-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-28-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-27-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2152-24-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-20-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1932-30-0x0000000073FF0000-0x00000000746DE000-memory.dmp

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 8d2faf1c3a857566f516c28da34b9479
SHA1 6151cc6fe9097e07676b8e7dca4057d4be292f44
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
SHA512 42c3908b63b7b5960c53b11f34e8b42efa361107491236730d30dc258857006d0e7078d3c529fddbe2c44ffad1fc3ee181de01b51dc2e52e5fc38c43d6672420

memory/988-58-0x00000000012B0000-0x0000000001352000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-28 17:54

Reported

2024-04-28 17:55

Platform

win10v2004-20240419-en

Max time kernel

42s

Max time network

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4164 set thread context of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4164 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 4164 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 4164 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4164 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe
PID 4204 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 4204 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe
PID 4204 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp67B3.tmp"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /0

C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe

"C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8d2faf1c3a857566f516c28da34b9479.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8d2faf1c3a857566f516c28da34b9479.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 ip-api.com udp

Files

memory/4164-0-0x0000000000620000-0x00000000006C2000-memory.dmp

memory/4164-1-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/4164-2-0x0000000007510000-0x0000000007520000-memory.dmp

memory/4164-3-0x0000000007CD0000-0x0000000008274000-memory.dmp

memory/4164-4-0x0000000007800000-0x0000000007892000-memory.dmp

memory/4164-5-0x0000000002890000-0x000000000289A000-memory.dmp

memory/4164-6-0x000000000A500000-0x000000000A59C000-memory.dmp

memory/4164-7-0x0000000007C90000-0x0000000007CB0000-memory.dmp

memory/4164-8-0x0000000008B80000-0x0000000008B94000-memory.dmp

memory/4164-9-0x0000000005250000-0x00000000052A4000-memory.dmp

memory/2300-14-0x0000000000C80000-0x0000000000CB6000-memory.dmp

memory/2300-15-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/2300-17-0x0000000004830000-0x0000000004840000-memory.dmp

memory/2300-16-0x0000000004830000-0x0000000004840000-memory.dmp

memory/2300-18-0x0000000004E70000-0x0000000005498000-memory.dmp

memory/1080-19-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/1080-22-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/1080-21-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4164-20-0x0000000074740000-0x0000000074EF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp67B3.tmp

MD5 33c0ea443961c21c287e6690713bb11e
SHA1 419cdf68f115aa0bbd4d7f3a0fd4d66577a718ad
SHA256 f810a18a1c97777a6c0481a9c109c5a2fd20987c1de00220538f7bbb03f040cd
SHA512 e6679b3fad0171435a8b41239523404b042e221205bfad211e220f9b26df5d750ff98cb4a64a493cc241de132bdf39c5f7823069eadd1c709f2f89daf9062046

memory/2300-26-0x00000000056A0000-0x0000000005706000-memory.dmp

memory/2300-25-0x0000000005630000-0x0000000005696000-memory.dmp

memory/2300-24-0x0000000005590000-0x00000000055B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_is20clb3.5tj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2300-37-0x0000000005710000-0x0000000005A64000-memory.dmp

memory/4204-43-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4164-48-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/1080-49-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

memory/1080-50-0x0000000006070000-0x00000000060BC000-memory.dmp

memory/208-53-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-52-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-51-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-63-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-62-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-61-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-60-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-59-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-58-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/208-57-0x00000282BE6E0000-0x00000282BE6E1000-memory.dmp

memory/1080-64-0x0000000006F70000-0x0000000006FA2000-memory.dmp

memory/2300-75-0x0000000074FD0000-0x000000007501C000-memory.dmp

memory/1080-76-0x0000000006FB0000-0x0000000006FCE000-memory.dmp

memory/1080-86-0x0000000006FE0000-0x0000000007083000-memory.dmp

memory/1080-65-0x0000000074FD0000-0x000000007501C000-memory.dmp

memory/1080-88-0x0000000007310000-0x000000000732A000-memory.dmp

memory/1080-87-0x0000000007960000-0x0000000007FDA000-memory.dmp

memory/1080-89-0x0000000007380000-0x000000000738A000-memory.dmp

memory/1080-90-0x0000000007590000-0x0000000007626000-memory.dmp

memory/2300-91-0x0000000007250000-0x0000000007261000-memory.dmp

memory/1080-92-0x0000000007540000-0x000000000754E000-memory.dmp

memory/2300-93-0x0000000007290000-0x00000000072A4000-memory.dmp

memory/1080-94-0x0000000007650000-0x000000000766A000-memory.dmp

memory/2300-95-0x0000000007370000-0x0000000007378000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1969bf6d528769ce62f1bf7126d85673
SHA1 059368849f3a143acd04be34c6ded8ae404e1ff6
SHA256 22cd80082f31c7a2406075ae7e1305f8b44e9eb53d3c5e6c1969812c0c25458c
SHA512 8a78150509d40c1a760939a9bc82551442ce1efd736b3b543dd40848bf92ceaa9a9ad2b54d87dd7446cb93cfbf77b141b7aef626f9f45ce90bd38b677825a1fa

memory/2300-101-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/1080-102-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/4452-112-0x0000000006400000-0x0000000006754000-memory.dmp

memory/4452-114-0x0000000006930000-0x000000000697C000-memory.dmp

memory/4452-115-0x000000006F820000-0x000000006F86C000-memory.dmp

memory/4452-125-0x0000000007B40000-0x0000000007BE3000-memory.dmp

memory/4452-126-0x0000000007E20000-0x0000000007E31000-memory.dmp

memory/4452-127-0x0000000007E80000-0x0000000007E94000-memory.dmp

memory/2352-129-0x0000000006020000-0x0000000006374000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7b3ef20385fc7fd8fc5bb54f1ccbc2d3
SHA1 13f8b8379e703fa72124eb8a2881a35690fefdaa
SHA256 c428b32afe02c02a5e240e17617219b30b06fe81e0d2732683f523166fee9b74
SHA512 18db77a1a4d9b77ec5cc40def382856da6875b2c839e96737457cadea58aa20bf2c5a11ee2c5967b389173efa0275b7ec2e04670f84112de0156292b90709dee

memory/2352-140-0x000000006F820000-0x000000006F86C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d773aabefd8b450a6cf8a1732e02c37b
SHA1 04cd4d511ba2692a4942a2193093ec20f0b811b4
SHA256 ed07edb2a3ccf7514c29e82ced81a8eadf28899c98d45c1e87c0d603fedc1c18
SHA512 edc22ed73c1d82bd3502a7f5f62c391b657f4916fe7e894f1e23b5f13d922f3e813c86c6a46cc9f548a521ddfa7cf67bff66004e31fcd6c64e50e9c7af4e72b5

memory/1816-161-0x000000006F820000-0x000000006F86C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fbca1d602334e1d5c726bdf45b04a5d6
SHA1 e19d37e544f4285c8ea0776d3564d30a4e132c64
SHA256 61bf9d8ab3d761b2ed8a28cb5864e967275fbdbc6ee902246675dc78c71cd494
SHA512 810ccc2581c4b15e9bb347275cfc88f3f3e86487a7eb8c56f4e973b5080d653e9516f31c36fa9ec7979b885837173819c4c17e96c889d413296b8cc4f54f05d2

memory/2640-182-0x000000006F820000-0x000000006F86C000-memory.dmp

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 8d2faf1c3a857566f516c28da34b9479
SHA1 6151cc6fe9097e07676b8e7dca4057d4be292f44
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
SHA512 42c3908b63b7b5960c53b11f34e8b42efa361107491236730d30dc258857006d0e7078d3c529fddbe2c44ffad1fc3ee181de01b51dc2e52e5fc38c43d6672420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk

MD5 4413be1e33cde61028bb9fedce1681c1
SHA1 56972a9fea34f3ff928eaa534c96c981999ec444
SHA256 1943e9ddc08653c41fab42b26676edc7be9f6c533028a022fad6868ab748a3a6
SHA512 a8b99047b48336c9054969a3b76f2cf6a84e56eb7a4594c2d119307e98b2f1fe0bafeaf567b46a6d06b6113a78d32b8e141eb96d21cbc8a106c1a99fb786377f