xworm | 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Size 627KB
Sample240429-bwvc1sec55
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
MD5 8d2faf1c3a857566f516c28da34b9479
SHA1 6151cc6fe9097e07676b8e7dca4057d4be292f44
SHA512 42c3908b63b7b5960c53b11f34e8b42efa361107491236730d30dc258857006d0e7078d3c529fddbe2c44ffad1fc3ee181de01b51dc2e52e5fc38c43d6672420
SSDEEP 12288:RgKJTegcva42lE21vVHEMsAi17CYcX685uQa5ro+sFUXPhuExaMpxfBJUw/:47a44E29Z1aCYcluI+ft
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000

Mutex

bBT8anvIxhxDFmkf

Attributes

Install_directory
%AppData%
install_file
explorer.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2928-43-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/2928-43-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/memory/2928-43-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

Executes dropped EXE 6 IoCs

pid	Process
4580	explorer.exe
2320	explorer.exe
4604	explorer.exe
928	explorer.exe
2316	explorer.exe
3700	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe"	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 4580 set thread context of 928	4580	explorer.exe	116
PID 2316 set thread context of 3700	2316	explorer.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1248	schtasks.exe
1148	schtasks.exe
1208	schtasks.exe
720	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
1972	powershell.exe
1948	powershell.exe
1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
1972	powershell.exe
1948	powershell.exe
452	powershell.exe
452	powershell.exe
1696	powershell.exe
1696	powershell.exe
4528	powershell.exe
4528	powershell.exe
4392	powershell.exe
4392	powershell.exe
2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
4580	explorer.exe
4580	explorer.exe
4580	explorer.exe
4580	explorer.exe
4144	powershell.exe
4916	powershell.exe
4580	explorer.exe
4580	explorer.exe
4580	explorer.exe
4580	explorer.exe
4580	explorer.exe
4144	powershell.exe
4916	powershell.exe
2316	explorer.exe
2316	explorer.exe
2316	explorer.exe
2316	explorer.exe
1196	powershell.exe
4844	powershell.exe
2316	explorer.exe
1196	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
Token: SeDebugPrivilege	4580	explorer.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	928	explorer.exe
Token: SeDebugPrivilege	2316	explorer.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	3700	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1972	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	87
PID 1476 wrote to memory of 1972	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	87
PID 1476 wrote to memory of 1972	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	87
PID 1476 wrote to memory of 1948	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	89
PID 1476 wrote to memory of 1948	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	89
PID 1476 wrote to memory of 1948	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	89
PID 1476 wrote to memory of 1248	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	91
PID 1476 wrote to memory of 1248	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	91
PID 1476 wrote to memory of 1248	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	91
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 1476 wrote to memory of 2928	1476	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	93
PID 2928 wrote to memory of 452	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	95
PID 2928 wrote to memory of 452	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	95
PID 2928 wrote to memory of 452	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	95
PID 2928 wrote to memory of 1696	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	97
PID 2928 wrote to memory of 1696	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	97
PID 2928 wrote to memory of 1696	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	97
PID 2928 wrote to memory of 4528	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	99
PID 2928 wrote to memory of 4528	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	99
PID 2928 wrote to memory of 4528	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	99
PID 2928 wrote to memory of 4392	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	101
PID 2928 wrote to memory of 4392	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	101
PID 2928 wrote to memory of 4392	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	101
PID 2928 wrote to memory of 1148	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	103
PID 2928 wrote to memory of 1148	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	103
PID 2928 wrote to memory of 1148	2928	93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe	103
PID 4580 wrote to memory of 4144	4580	explorer.exe	108
PID 4580 wrote to memory of 4144	4580	explorer.exe	108
PID 4580 wrote to memory of 4144	4580	explorer.exe	108
PID 4580 wrote to memory of 4916	4580	explorer.exe	110
PID 4580 wrote to memory of 4916	4580	explorer.exe	110
PID 4580 wrote to memory of 4916	4580	explorer.exe	110
PID 4580 wrote to memory of 1208	4580	explorer.exe	112
PID 4580 wrote to memory of 1208	4580	explorer.exe	112
PID 4580 wrote to memory of 1208	4580	explorer.exe	112
PID 4580 wrote to memory of 2320	4580	explorer.exe	114
PID 4580 wrote to memory of 2320	4580	explorer.exe	114
PID 4580 wrote to memory of 2320	4580	explorer.exe	114
PID 4580 wrote to memory of 4604	4580	explorer.exe	115
PID 4580 wrote to memory of 4604	4580	explorer.exe	115
PID 4580 wrote to memory of 4604	4580	explorer.exe	115
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 4580 wrote to memory of 928	4580	explorer.exe	116
PID 2316 wrote to memory of 1196	2316	explorer.exe	118
PID 2316 wrote to memory of 1196	2316	explorer.exe	118
PID 2316 wrote to memory of 1196	2316	explorer.exe	118
PID 2316 wrote to memory of 4844	2316	explorer.exe	120
PID 2316 wrote to memory of 4844	2316	explorer.exe	120
PID 2316 wrote to memory of 4844	2316	explorer.exe	120
PID 2316 wrote to memory of 720	2316	explorer.exe	121
PID 2316 wrote to memory of 720	2316	explorer.exe	121
PID 2316 wrote to memory of 720	2316	explorer.exe	121

C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66D8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
  "C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1148

C:\Users\Admin\AppData\Roaming\explorer.exe
C:\Users\Admin\AppData\Roaming\explorer.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F97.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1208
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:928

C:\Users\Admin\AppData\Roaming\explorer.exe
C:\Users\Admin\AppData\Roaming\explorer.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp15E0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:720
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explorer.exe.log
Size 1KB
SHA256 c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
MD5 400f1cc1a0a0ce1cdabda365ab3368ce
SHA1 1ecf683f14271d84f3b6063493dce00ff5f42075
SHA512 14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download