xworm | fe3147f86b26fd633dc86f6104010d34326fa015e1cc1cb44c6e13dfadf5842f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

46KB
MD5

f057994465d01526751fd54b2d51211f
SHA1

6c5f8b5f144cb461c423a19e19b80c7592da2adb
SHA256

fe3147f86b26fd633dc86f6104010d34326fa015e1cc1cb44c6e13dfadf5842f
SHA512

ce9fe02b419029708fd1c9ad57fbb678a741c60948c8e75ef51e221b5adf7b2bd27d7a9aedb81d8910f3b443804d5fec8016f928ceb606fd367fa7aea8878ad0
SSDEEP

768:YnxE3+8AgNT7IqTpGhJduILzFh0gFEPI9O0Lr68Ouhvzj09:Yn2+86JtXFr9Zn68OuJW

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

users-bikes.gl.at.ply.gg:60963

Mutex

gkvCDExYHD5vnCdW

Attributes

Install_directory
%Temp%
install_file
solara.exe
telegram
https://api.telegram.org/bot7146936438:AAE_9wNhZKkwFCU2TNwhMIogBHJX_-QiQso/sendMessage?chat_id=1380863399

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4140-1-0x0000000000BC0000-0x0000000000BD2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

5064 powershell.exe
536 powershell.exe
2196 powershell.exe
2160 powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\solara.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\solara.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\solara.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
14	ip-api.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{60077BF8-65A4-4EE2-8CB5-BE48D1213AB6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5064	powershell.exe
5064	powershell.exe
536	powershell.exe
536	powershell.exe
2196	powershell.exe
2196	powershell.exe
2160	powershell.exe
2160	powershell.exe
4140	XClient.exe
1020	msedge.exe
1020	msedge.exe
1100	msedge.exe
1100	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4492	msedge.exe
4492	msedge.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe
4140	XClient.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4140	XClient.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	4140	XClient.exe
Token: 33	3736	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3736	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

4140 XClient.exe

pid	process
4140	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

XClient.exemsedge.exe

description	pid	process	target process
PID 4140 wrote to memory of 5064	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 5064	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 536	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 536	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 2196	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 2196	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 2160	4140	XClient.exe	powershell.exe
PID 4140 wrote to memory of 2160	4140	XClient.exe	powershell.exe
PID 1100 wrote to memory of 1524	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1524	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 2204	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1020	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1020	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1372	1100	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\solara.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'solara.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff99e9f46f8,0x7ff99e9f4708,0x7ff99e9f4718
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
2⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
2⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 /prefetch:8
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
2⤵
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 /prefetch:8
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
2⤵
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
2⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17056253880415047115,8827173968921138781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
2⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x2c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
0418134d104699678ab85456f8199a88

SHA1
adfe21ddd67e86ae538d9e72156ba77be6cf49fd

SHA256
731c5aa12dd3a2ed22206ca2471f6a4bb9b1be7a1c9cd1336313fb4a6152f7c5

SHA512
ca789e40cdeddfd34ffbe83a26a4c21bb725dd91267da38d48466ed4044de3c02793adafb91eed6a34280b2338415da3944b3717ad46f98354bc3918c78d600b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
4c3513a59f48a16a777e1c9b35ac65a1

SHA1
78f9046d0057d6fb25daaeb63ab72225072bbf51

SHA256
5e0ce0efc7bb37e34b5a79c8046533c646347acacca0af0481ecaf8189e819c2

SHA512
c9ae51e33ec9af850cafa5c4bc76c2a7c13071f2eec7e8a2815f6a13126b86ac4628aa6fd8e8e3bb96655044f16ccd5b6366299b8c521fbc5dfe9524d0ea6552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d2bec4af3854a2163ef75b699775344f

SHA1
4ccb8b2d384707c707a25187bc3a2119487f45b6

SHA256
aa0496bd448ba5625479df94698299e3f29722c2892cd05f2e60e7c84377cee7

SHA512
9519806c06422a6e273e94e39ecd7ce181b26319c24b6c02bd4f08973d35373be6be45194a23b32f124e473884ee16b9e1e962efc3cbcdc108dfc80dddcac953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9624b7867f4ad02571adb8b521878ccf

SHA1
0178ccdbf54f72e24c1c9fd139ca83b3c5832378

SHA256
1373ad41782475a68375d1e469a81efda0759ce2d01fd514bfefdd604f2b6641

SHA512
731253ac4a0be083996a69009d71f6b53e5ed95ff1ac1f1dae6ef7a7e47b45040c4b2cd0c9b24d7984dd64938c0f22b03e671dcec48f82fa41884351cc277c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7a89960ad8bb298d692a6afb1fc0b22e

SHA1
8c92a6536da3614d2d688c32b93f5095611b5b60

SHA256
4272fa5b27ff38fb8dda57d310119eb202300ca4a1ffc1ee6103b97c87993db3

SHA512
6e85a0a42b63641173ffc3aea9607a57c25535cbe3b6831a4187257c3eee5a813457cecc5c6b698ca32b3afc4ebfd2c7d43d96428bf351b4659e52daff1df6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Filesize
2KB

MD5
b2372d1b6e11e3264a80595109df7c62

SHA1
d65b9ee9b8fb3748930a1d51a57fe8f7980fcb83

SHA256
cafec03a7a73e2c5b8aee511e7712c5d28a1fabc5a95e177c46c6767ae4658b7

SHA512
83fe7ef72e231da76d4c6c1056c8a120cc0bc2682aaf155f5808698c5b96d1de5fa2de0666e9a79b5424721e9ec07428e0e4b603535714e534e77bb43ca9e939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
53ca382824489d901fceb26a5a8f2c47

SHA1
2a092cac8bd97ff73b9673dccfbaf040803e63fa

SHA256
29dc5c79c47eca9854227d61d702b215780d7ca1552105db8f0b06decb5742bf

SHA512
76750d1b960cc38b2a86403ee5635cbadac649018f1d793764637d65276f81db85c90cdaa307ec3e267f15810920a37839adc0ca301557de6ff901b528602938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5980cf.TMP
Filesize
48B

MD5
2951651288810f89ae97bbef1d5f5af7

SHA1
d47291a9c9e9e0cc0db660625fe07343c14f54d3

SHA256
2def5bae0950a700b7d8ed9607da23c6955881fa44218ae5bd558c9a68c70179

SHA512
b8934c75ecc1245dbfd69389d087cf34fb9cc1bd106238d1e315351543577609b1ba5cc6fad2fa59446e16d16338c67fb3e86c33577f6f14c96940a74b01a454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
631d484a3776c53cb07ab18a76c64e80

SHA1
b44806a6cb9de79d13bbb9076b35e9026ec056f6

SHA256
80d43ca8b4f89ceea194bcfd5b05959312cb85cf2a4013398bf364a3726e4ae1

SHA512
aac08305fedc932eaa02de987e6fd2887c8faa58e6820c23fd99b3f7d020ccc95e0b591c6fbf8a33107ee4e1f20a85f37c23a56852c5705b4c0a01e6152df6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
da679320d358df91bd853ceecbfa9e31

SHA1
6973ae49a07ef85ce192e1604ab39eb9bd457f5a

SHA256
2ab4f3ce37452879482c15ce3ca58754670192a79794569accb3a3cb5f9c1adc

SHA512
b0d35217654af5c903c2b1a29531a61e27a6c38023db9a5629353411dcce07a9c4ecc79686f24e9a4ed1973f83896183fb0c637082ca98fcb2187f532fef105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5952ba.TMP
Filesize
538B

MD5
223293a3fc5f4cb19b1b758ad73ea525

SHA1
c99d6d44d1e5ff7c6d7607615b65fa71beb39c07

SHA256
e24f44c96e54fe7062bef53d0ee5eeb5cb2eed44902712beea055964220cc8e0

SHA512
d9730cc9248e47c984aff2a1e4974c3be6e5bd9896060b9660a8c81baa22e4474adc52a6e5d2c7feb9ec8584ea902f268dabd67eb65297975a37881953c6b56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
88b0cab36f4956ba783d53d8a4734351

SHA1
4fd86148c8bd967d7a543d084513389eb0e86edc

SHA256
322bdfa3691944c380e9029cbe3aee048ddf3b4490651cd3af1bbf5889ce82dc

SHA512
e26e73af5affa8fd853bb6ae9893df0eec04a8fb199f8569aca253f0323f8b436f3ec50edbcabfa67dc499e5659a191ae1d980bb0a68c208be94f0b4c0f16a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d14ccefeb263594e60b1765e131f7a3

SHA1
4a9ebdc0dff58645406c40b7b140e1b174756721

SHA256
57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c

SHA512
2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ktrvjoy.pqy.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_1100_QAMUKPUPDQQJFWDT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4140-58-0x00000000012A0000-0x00000000012AC000-memory.dmp

Filesize
48KB

Download
memory/4140-57-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download
memory/4140-0-0x00007FF9A4673000-0x00007FF9A4675000-memory.dmp

Filesize
8KB

Download
memory/4140-2-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download
memory/4140-1-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/5064-18-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download
memory/5064-11-0x000001569F830000-0x000001569F852000-memory.dmp

Filesize
136KB

Download
memory/5064-5-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download
memory/5064-4-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download
memory/5064-3-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Filesize
10.8MB

Download