xworm | 8c03cbb593249772dfce73a9f21a7e7ca7b5afdf9e60f97a093bc6f2a8ad7cf8

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x/data/sms.exe
Size 9.3MB
Sample240605-sh37fabc39
SHA256 0c2e058f82341a8b2b4460cd0bdbf2ed9156295e5e9a64b68aa320b817f2fb1d
MD5 2fda729af7be83624fe7b5c61d2d36a0
SHA1 68ee34c9d368b0a201f9a574c19fe700974a6563
SHA512 869a40de2075764b03720f9a176615a15fd67b69d0e04bdfa1c596f9315ca4aaae1161aadcd1ae47cc23fdb9872e7b7c58f0ee8b00784f2559e3a4664ce2883e
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDa7Gw:k2ldIVdy4afBW62duNJ2aT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence pyinstaller rat trojan

Malware Config

Extracted

Family

xworm

Version

89.213.177.171:7000

Mutex

Y84cQ8sTyNg3D9Ue

Attributes

Install_directory
%ProgramData%
install_file
VLC_Medai.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral7/memory/3036-56-0x0000000000E90000-0x0000000000EA2000-memory.dmp	family_xworm
behavioral7/files/0x0036000000016d45-46.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1736	powershell.exe
3016	powershell.exe
856	powershell.exe
2872	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Medai.lnk	api.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Medai.lnk	api.exe

Executes dropped EXE 6 IoCs

pid	Process
1200	._cache_sms.exe
2736	Synaptics.exe
2232	._cache_Synaptics.exe
2500	sms.exe
3036	api.exe
2780	sms.exe

Loads dropped DLL 8 IoCs

pid	Process
2980	sms.exe
2980	sms.exe
2980	sms.exe
2736	Synaptics.exe
2736	Synaptics.exe
1200	._cache_sms.exe
2500	sms.exe
2780	sms.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	sms.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral7/files/0x000500000001923b-41.dat	pyinstaller
behavioral7/files/0x000500000001923b-39.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2476	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1736	powershell.exe
3016	powershell.exe
856	powershell.exe
2872	powershell.exe
3036	api.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	api.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	3036	api.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	EXCEL.EXE
3036	api.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1200	2980	sms.exe	28
PID 2980 wrote to memory of 1200	2980	sms.exe	28
PID 2980 wrote to memory of 1200	2980	sms.exe	28
PID 2980 wrote to memory of 1200	2980	sms.exe	28
PID 2980 wrote to memory of 2736	2980	sms.exe	29
PID 2980 wrote to memory of 2736	2980	sms.exe	29
PID 2980 wrote to memory of 2736	2980	sms.exe	29
PID 2980 wrote to memory of 2736	2980	sms.exe	29
PID 2736 wrote to memory of 2232	2736	Synaptics.exe	30
PID 2736 wrote to memory of 2232	2736	Synaptics.exe	30
PID 2736 wrote to memory of 2232	2736	Synaptics.exe	30
PID 2736 wrote to memory of 2232	2736	Synaptics.exe	30
PID 1200 wrote to memory of 2500	1200	._cache_sms.exe	32
PID 1200 wrote to memory of 2500	1200	._cache_sms.exe	32
PID 1200 wrote to memory of 2500	1200	._cache_sms.exe	32
PID 1200 wrote to memory of 3036	1200	._cache_sms.exe	34
PID 1200 wrote to memory of 3036	1200	._cache_sms.exe	34
PID 1200 wrote to memory of 3036	1200	._cache_sms.exe	34
PID 2500 wrote to memory of 2780	2500	sms.exe	35
PID 2500 wrote to memory of 2780	2500	sms.exe	35
PID 2500 wrote to memory of 2780	2500	sms.exe	35
PID 3036 wrote to memory of 1736	3036	api.exe	37
PID 3036 wrote to memory of 1736	3036	api.exe	37
PID 3036 wrote to memory of 1736	3036	api.exe	37
PID 3036 wrote to memory of 3016	3036	api.exe	39
PID 3036 wrote to memory of 3016	3036	api.exe	39
PID 3036 wrote to memory of 3016	3036	api.exe	39
PID 3036 wrote to memory of 856	3036	api.exe	41
PID 3036 wrote to memory of 856	3036	api.exe	41
PID 3036 wrote to memory of 856	3036	api.exe	41
PID 3036 wrote to memory of 2872	3036	api.exe	44
PID 3036 wrote to memory of 2872	3036	api.exe	44
PID 3036 wrote to memory of 2872	3036	api.exe	44

C:\Users\Admin\AppData\Local\Temp\x\data\sms.exe
"C:\Users\Admin\AppData\Local\Temp\x\data\sms.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\x\data\._cache_sms.exe
  "C:\Users\Admin\AppData\Local\Temp\x\data\._cache_sms.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Users\Admin\AppData\Roaming\sms.exe
    "C:\Users\Admin\AppData\Roaming\sms.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Roaming\sms.exe
      "C:\Users\Admin\AppData\Roaming\sms.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2780
- - C:\Users\Admin\AppData\Roaming\api.exe
    "C:\Users\Admin\AppData\Roaming\api.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\api.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'api.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VLC_Medai.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VLC_Medai.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\x\data\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\x\data\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2232

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 8.6MB
SHA256 2d1282e2751a56b9320481cf69ab484ae3a5bc9fe2c4f64c6a327f64f32a0a15
MD5 2e2199b2a71a92568a9ad1adb420d812
SHA1 294c5c62dd43c70eb5e106d0852f4144b2f42b45
SHA512 e5be67a2622badb5156baad90b81b7bb5479b51cc0b9c826b3791c302f3a52d8a8700d02d16dc57e9fb98200cfd4c5d6947e4d81a03efc3e7fa2e135e3299dc2
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDP:k2ldIVdy4afBW62duNJ2P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 8.9MB
SHA256 c5c75b311f6a7f2f076b89baacae57d5abfc50c5754b6b5e20206800a0d74e9b
MD5 6c64c1ad6356c2661d7a566ddc9491bb
SHA1 cb5da33fa60f60e98bf66336b6a188a0fcca8517
SHA512 b455dd119da9940499285891a6b39a8d656bac715dfb757c2a399efc30a27221beee23961976682bf1f6385ac7179779989b9030d03fd499e02a8676e76b95a4
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDb:k2ldIVdy4afBW62duNJ2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 9.3MB
SHA256 0c2e058f82341a8b2b4460cd0bdbf2ed9156295e5e9a64b68aa320b817f2fb1d
MD5 2fda729af7be83624fe7b5c61d2d36a0
SHA1 68ee34c9d368b0a201f9a574c19fe700974a6563
SHA512 869a40de2075764b03720f9a176615a15fd67b69d0e04bdfa1c596f9315ca4aaae1161aadcd1ae47cc23fdb9872e7b7c58f0ee8b00784f2559e3a4664ce2883e
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDa7Gw:k2ldIVdy4afBW62duNJ2aT
MD5 SHA1 SHA512 SSDEEP

Submit Download

G2gomYH4.xlsm

Path C:\Users\Admin\AppData\Local\Temp\G2gomYH4.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25002\python312.dll
Size 6.6MB
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
SSDEEP 49152:77dFcaC296MwQx0AWOO5JqSEShouly4XUV/x3aOvi5lnX79DxW/En8tdFNPhD2SI:7Z+aCnAh8lRA4jvE0ivHHDMiEBaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\x\data\._cache_Synaptics.exe
Size 7.9MB
SHA256 47ae45c987851784e2cc06c7ebf86010d716598ead645a577c63afc7270ee612
MD5 9abb8962233a50c5605e8bc06e89ca81
SHA1 e843bc0cdbc6acfdfe77e6eab43d79bc4844e5ae
SHA512 888f41e6e67c3d31be81fc7e39b5e53d69368255f58c240263c217d6ec57c4f9334a8536efabad86fec92bc9f823c248dbeacc146f21481873e0efe8378157cd
SSDEEP 196608:ul5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDV:uldIVdy4afBW62duNJ2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_sms.exe

Path C:\Users\Admin\AppData\Local\Temp\x\data\._cache_sms.exe
Size 8.6MB
SHA256 efb134deb93a04c7a7a5c8d00bf7b393c008c23d6016d2ad3aa92959b88e7603
MD5 6a72160119af48fdf259c1c62f588d3c
SHA1 0edf9f884423fa9346019a26265a8e8c63c956a5
SHA512 fbfd85c77bf85b7ab2c40d9e480e6e61a10ec6d6a3bf2f00f472913873aa34886e763b7ad594dd6d100cb401af0d7b194a8ee5d53ffb95e9ba14076312f8a5f9
SSDEEP 196608:ul5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDa7G:uldIVdy4afBW62duNJ2a
MD5 SHA1 SHA512 SSDEEP

Submit Download

3I51RUO9FWBURXPYBO7A.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3I51RUO9FWBURXPYBO7A.temp
Size 7KB
SHA256 ceb2cde8215b69f464f92978660b94f8529a54c2ab7fe9d88aa4545eba4bef68
MD5 7c43d5205625290b2e0e45a4b49a0271
SHA1 154517ac5c4d1593c1b4b6a12fb93566de15d8e0
SHA512 0559b63a7845337917a50439db83e4ee17f3f2e034ce3d3b065736e9ed5642d9122746582a84bfb9c48ce7be75bf9e064a7191dae9d38310730a1c7a1ad74724
SSDEEP 96:YJaCdM8R3nqvsqvJCwo3JaCdM8R3nqvsEHyqvJCworDIz63QH0J7Dm3XlUVC:AP93UoZP93AHnorDR3NJ7Dm3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

api.exe

Path C:\Users\Admin\AppData\Roaming\api.exe
Size 50KB
SHA256 a0ae2e320fb5decbe74a6e244a72aec0910698b6adb1af8e6231839d8bfdf6ea
MD5 4b35086a870a2f7a2bad2552cb623b0f
SHA1 0e8f5e5df57bfe267a465f04ca43d91b412bc618
SHA512 09973f31cd6d61b886f4704fec8fea20941e3424875f5904b89b69c67bfa1d0afcb615771b3555a4c63f00f00db1bfdd17d345ec8312aeac906eb08241b46295
SSDEEP 1536:Tf05a/CTjK89LFc9Uz868OMOtdS1EAd8II1:Tf05a/CTR9LFc9UziOMigEA6II1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sms.exe

Path C:\Users\Admin\AppData\Roaming\sms.exe
Size 8.4MB
SHA256 aba6f840e2fdff76e560d6262fdf6614ef99fad5e7990690eb4bdfc0dfa8da79
MD5 510d3870a1be7dca6364fbea89ab77f3
SHA1 89b9dc9e741c4710aa3a930f7b2f6c3999add786
SHA512 a2d8b92f4b21deccd17d5d130d120810e4267797f74c90f8b19987721add42efa4b9e343b79d6fd9cc71af1bd2802791e948ba483f7f0c832cbf3a623ff92d88
SSDEEP 196608:PsvljLqBA1HeT39IigwdeE9TFa0Z8DOjCdylrotFnz4Qdd9rxUK:S6q1+TtIiFUY9Z8D8CclcD02xUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path \ProgramData\Synaptics\Synaptics.exe
Size 8.1MB
SHA256 fc37e4e09e4c9c5bd3bac42cfd0725f662e629ebf19104b9d40a224cc03c988f
MD5 4a809b8acf7135c014c041b943a4e3d7
SHA1 c50f660834dc9adf4869b2afd68fd4879ef2f6bb
SHA512 f9665b52714dc928af65a246c3703de3d78ae44157a178dfba6020e95e0bb214b660afb44a45644f4b6ae230585d385d368704d10e8cdf3acfd6ed74bf58605d
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJ5:k2ldIVdy4afBW62duN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path \ProgramData\Synaptics\Synaptics.exe
Size 8.4MB
SHA256 cba03081349912014e370dae85b519c45726ea9dcc4af4d78b3e713a16084211
MD5 e45a113047e9b82febd55d80fd6fd29c
SHA1 d49e2f5dd1b9237d9165d926f5e20180b3f09293
SHA512 804491597b1e0af244c4616d75f735ca82a6124bd646642a81efe20c0ac69fb19ead2f347ead044c3ee3c63e568a998c05c01d60ff375697d1bdf1bc91d7da92
SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2/:k2ldIVdy4afBW62duNJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_Synaptics.exe

Path \Users\Admin\AppData\Local\Temp\x\data\._cache_Synaptics.exe
Size 7.8MB
SHA256 07962f269a9868c764fa98f7ae3d51359741945763957602f7199e99112c01ae
MD5 53dfef74d0257d3c2e2b0c615d6c78c5
SHA1 8c9627366a4590f505cecb77b5d7b06a0631c72e
SHA512 a8a604de32a70d4875bdf048371d97351f4e55488c009ef07e1c0464586119b564235ac28bd2b0b2821e01d179a934339c10ac17c91ce73c326c6a70fd40edbd
SSDEEP 196608:ul5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDi:uldIVdy4afBW62duNJ2i
MD5 SHA1 SHA512 SSDEEP

Submit Download

sms.exe

Path \Users\Admin\AppData\Roaming\sms.exe
Size 7.9MB
SHA256 876504b0144acea0c253280af0059876c9b0afa3ea254991efc4a4506af577ae
MD5 5c37f9b1a920738e53f89a8594e26b11
SHA1 a33d661a388a497a2ecf8a53aee5d13f9ea28dc4
SHA512 901fe58974bd8cc5348aae2bf23a34d710d269ba837f5b9b62d6f029095a81f0be23ebdf615aade1377c20bc4fa21da98929a0ddd2f687dd538f350842e97bdb
SSDEEP 196608:PsvljLqBA1HeT39IigwdeE9TFa0Z8DOjCdylrotFnz4Qdd9a:S6q1+TtIiFUY9Z8D8CclcD0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-111-0x0000000001F80000-0x0000000001F88000-memory.dmp

Download

memory/856-110-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/1200-26-0x0000000000020000-0x00000000008B4000-memory.dmp

Download

memory/1736-97-0x00000000004F0000-0x00000000004F8000-memory.dmp

Download

memory/1736-96-0x000000001B710000-0x000000001B9F2000-memory.dmp

Download

memory/2232-36-0x0000000000E90000-0x0000000001724000-memory.dmp

Download

memory/2476-71-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2736-140-0x0000000000400000-0x0000000000D4E000-memory.dmp

Download

memory/2736-176-0x0000000000400000-0x0000000000D4E000-memory.dmp

Download

memory/2872-117-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Download

memory/2980-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/2980-25-0x0000000000400000-0x0000000000D4E000-memory.dmp

Download

memory/3016-103-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Download

memory/3016-104-0x00000000022C0000-0x00000000022C8000-memory.dmp

Download

memory/3036-56-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Download