Malware Analysis Report

2024-09-11 14:54

Sample ID 240608-2bsxkahb9x
Target Funny.exe
SHA256 a53ea993bd31a24b3620978a84164bba38f592eb01f4d4cfe9bc4ae1af99c4a4
Tags
xworm execution persistence ransomware rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a53ea993bd31a24b3620978a84164bba38f592eb01f4d4cfe9bc4ae1af99c4a4

Threat Level: Known bad

The file Funny.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence ransomware rat trojan

Xworm

Xworm family

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Deletes itself

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Sets desktop wallpaper using registry

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Defacement
T1491
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-08 22:25

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 22:24

Reported

2024-06-08 22:29

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Funny.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\program N/A
N/A N/A C:\ProgramData\program N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\program = "C:\\ProgramData\\program" C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30cbf61ff3b9da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B781F21-25E6-11EF-AB41-FA5112F1BCBF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8663f303a2f3d429fe06289735c27cb00000000020000000000106600000001000020000000c2ff860ab028d87b1a2ebc3f375151a057c4356bd2993c96ff696005919bfc1a000000000e8000000002000020000000109fed181bdc4434be2ec87dbf162b47d7aba37ec950f31c4a3b9e0bfe382884200000000abe3b482e30007087b0ae52c6e2b67ee323cf0f73c43cccd1acda67455ee3be400000008b9248d498ec18023837cd0765c317aecdafafcf50c68159cd25f2e3e364a9413a64e5672cc37b6588560e5af3d0342b7c5737c979c061e610f4d703fab8e043 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424047518" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8663f303a2f3d429fe06289735c27cb000000000200000000001066000000010000200000007ff7b0dd2a83c1e3b93ceac892e760005b3d90a6b4d749f98303c41256f1c342000000000e8000000002000020000000d1b9f625e291417d8dc3c20e06b1fba988f2b19dc2afd65b1911cf48fed56dcb900000002318e36d8622f78e792f490123403ce9848d3b4f6c081a346172a5b40b7295bdc943527d151918ba321c4197fbacb4c3fbf11b31743694b7433b0eb082af26b1e9afaf68a4f46b901cb553e026bbf4aaf777245295e5ef5683dd02870edccb743ca8b3b438487382b619b365e7e3af16b784b3561fb502c0b7d664e87194fa98d1e318f0e1aade0a688ab1f7ff5d799c4000000079303e7419e7ce267e4b2c5188ec78fd52acf9c0622e0a75ac67e6a0a4b5806b8af50af74ac3ad82807e7eeddfd2258e86c1e88130c2cf76a570d40a70bcf103 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\program N/A
Token: SeDebugPrivilege N/A C:\ProgramData\program N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 1868 wrote to memory of 1916 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 1868 wrote to memory of 1916 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 1868 wrote to memory of 1916 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 2240 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2132 wrote to memory of 2280 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2132 wrote to memory of 2280 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2132 wrote to memory of 2280 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2132 wrote to memory of 2280 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1868 wrote to memory of 976 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 1868 wrote to memory of 976 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 1868 wrote to memory of 976 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\program
PID 2240 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\system32\cmd.exe
PID 2240 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\system32\cmd.exe
PID 2240 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\system32\cmd.exe
PID 2352 wrote to memory of 648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2352 wrote to memory of 648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2352 wrote to memory of 648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Funny.exe

"C:\Users\Admin\AppData\Local\Temp\Funny.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Funny.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Funny.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\program'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'program'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "program" /tr "C:\ProgramData\program"

C:\Windows\system32\taskeng.exe

taskeng.exe {91487873-838F-4A15-9332-D037AD3887BF} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

C:\ProgramData\program

C:\ProgramData\program

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2

C:\ProgramData\program

C:\ProgramData\program

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /f /tn "program"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBB73.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 by-mit.gl.at.ply.gg udp
US 147.185.221.20:3500 by-mit.gl.at.ply.gg tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2240-0-0x000007FEF5253000-0x000007FEF5254000-memory.dmp

memory/2240-1-0x0000000000F40000-0x0000000000F50000-memory.dmp

memory/2240-2-0x000007FEF5250000-0x000007FEF5C3C000-memory.dmp

memory/2628-7-0x00000000027F0000-0x0000000002870000-memory.dmp

memory/2628-8-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

memory/2628-9-0x0000000002990000-0x0000000002998000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 8139bc749f7094ce72689b76944c3bb5
SHA1 93790fd62523c37d7a01faa26de2877337d51c88
SHA256 d4d3239c90f49c53a281c3075fd34fcc322645f50a8a54139a6b03d562e443a4
SHA512 3b3cd037083139c5af83c561bc966b5f3daeeac5db390a50df5d5e7384437e42737f49f5784c4d5f01e6cef2b77079f1918843a0bb4d70049cd1df059363def0

memory/2516-15-0x000000001B4B0000-0x000000001B792000-memory.dmp

memory/2516-16-0x0000000002710000-0x0000000002718000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\ProgramData\program

MD5 90fc7afe1b516a9fa685089ae0f5f322
SHA1 94ee6cb901f16a3136607c0e194c1e76b5ac76d8
SHA256 a53ea993bd31a24b3620978a84164bba38f592eb01f4d4cfe9bc4ae1af99c4a4
SHA512 e3f5d77e6da170460d9bfa3273608397f3fb0bc98eb34ed1729c357681d449a443e54abf75259efceca98c1527e0ed6201154556a1e889b11901a1b53fb5f2c9

memory/1916-34-0x0000000000D00000-0x0000000000D10000-memory.dmp

memory/2240-35-0x000007FEF5253000-0x000007FEF5254000-memory.dmp

memory/2240-36-0x000007FEF5250000-0x000007FEF5C3C000-memory.dmp

memory/2240-37-0x000000001A740000-0x000000001A74C000-memory.dmp

C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

MD5 fe3907979d7da74e215004b312a2bcd6
SHA1 f18f1240bbaf4c03f68a5bc9984f3cff65a860af
SHA256 425e14c205234c2193ae9836f2f188c380d3a6ac3a092f58a6ecdc59324dd249
SHA512 6681d089c2d9ac5367445b0e20c38e1009b1763a5676b4027e13aa48f3f7e22081a4b7519377e964e1275b2c717d9a51e97cfc79cc29273003413b7082c99a21

C:\Users\Admin\Desktop\How To Decrypt My Files.html

MD5 022d4d61eddfa7c9a37e5a3d509bfee0
SHA1 d7d266e2f96388dbee969466c43b5f9d71628473
SHA256 c5d776934714336409fd9d857c76193baae9552aed2c9fef4b25e361e93f06bb
SHA512 a0dcc92389bc64e0b57743ee2034f31d2585cc92b82a4d47d5e1cce140fc4be787109d219d945bcb94cbce86335a05b13bd8caae8fc9dc4e453eca6bc7428f32

C:\Users\Admin\AppData\Local\Temp\CabD1B4.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarD295.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79b6d4d6179e92344038bc5a2a55acdf
SHA1 21e2fbf917dc3c7bab91e1041a3d18473f48e84e
SHA256 99be2c6d6f8acedead9cc7156ab7896b0e28415d36d5e7d89364a8580a27e933
SHA512 3a0e08ecde8404f2dc72c53477e2b8fcef5856636a4c59db416e7b06f703a2390f64615c2aac95f92eb6e4dfca8cf36b1c169cd32628b1ce1df6806297cfc0ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 661310851646719a4b849ef6ae1bb6a2
SHA1 f7aa3d2072e0017bb7e8390e07f90b91b00b7605
SHA256 84a87c218128bd41faecf4d29bc819659084b6de52550cbc33df0af139866006
SHA512 f935c824621599311e265860f462c42f3a700f0edf244c545fad6ec72b401b16d0f0909da148f5d40960f4283615e2b9661ff61804fa4a8be6d00e4ffe2d8d01

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7885e6321ea08500c8477f9355fb28cf
SHA1 99112cf2834e98b839da5fee5f204c9aa1cfd10e
SHA256 f8da37e2585f5287bcae0b6b79fa9aa64e0d58149b2ef2da3936db0bf32b55cf
SHA512 1263ba0ca6893ed962113cdb16ec96a35c01b513e2d0902528291e34a89ab2aa0aa7ec69df0a89e7d596ad63f6b5b07af1f0704985fca9de0778359833e00d7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc456b6aefb00b771efb9905a3245025
SHA1 b44c5de8bf539672dd8e11db0fbf91c7494686bf
SHA256 fc26a71be122eac5ade58709bb01804b7d0c89d550ea13c6ea82138a6ddef02b
SHA512 385bbe7ffdbb165f2db12f3e636e7dfe6159491620262e99a95bb7cfc8894c9b394ccb8ea8d9098a139d57ac102a7c7442bb07f1b73a3a9270647e70cdcf2ed7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64b7c98a304523e510814ca0e6a822c2
SHA1 8f6e2420bd04500dcd197832c28cf2c61b96877f
SHA256 d71d246c099893dbae89bb67fde11f75ffdfa82864badadef43f5aef99e06fd2
SHA512 675d814ffd1eb62f365d32ebd08f004a557d4711b08ef15820ad0aed17150b3470b51adcccebdfe77e4345b61417d362a66a116b504e408cbb48c5c525f62b13

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d177cbf932c2062097aae4a6646c1a9
SHA1 6c2f83c5d87946682e72d71bd234dc50607ca150
SHA256 4d4f2d1d547b09c98ff9fd6bc3d8c40c0221778ac922e7381f48ec2033257af1
SHA512 f9c000de520865b16f927a29a089e59f1f394f933daa22277c410a40e2d8cbf6f671ec7c904bdf27756966d620400720490b64440919fafe9cb673fab01c9125

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8057b4b63359220531531c070b0b8d8c
SHA1 3c7e4999fbc59607a3bd6e8f18b1f4913b82a9db
SHA256 f17e6fa88956d7b711a87aa64c2e812f07b6d3149b8fa7ab190881aa708057de
SHA512 d05cd516a684625c0b67a2b43667712a960b7fd80e93db0c014354bbde920838512d0fb56a3ef5ac048e3d11f61049209284bef04299edfd74f8fc7c7166e558

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80207e24c67ebd99cbfb2b93d9a323ea
SHA1 f7f4f7487d1912907815c2865ce09872e7818318
SHA256 4ca18f94e8dc45a8b8930e88a68af59437567e1a2169ba7dbb40ac806f2d2a53
SHA512 dc47f6fe8dbd74669bca5cb24731a3afc98ca644c8e784cc58b877b21e34a480272b3811dc3e7dc6654fbe595a72df6ad989a218bb4a5995ba092c88f97964fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be42c9492f463f573f5d73564871aa60
SHA1 08d70599182c78ac066441105eb31e552b03f7b7
SHA256 ca497e5899c45c975c9f3cd1f6d7ab634cf65d53f45e5c39b22d82a39aacf96c
SHA512 3520f9b742c9b4f541f6cf83cf04566283a999d2d192a7439a1d56ead5167f84099650a4fd4c428db0c5500a1ca82a821efb561b6a3ec643c3741c059691998c

memory/976-686-0x0000000000F00000-0x0000000000F10000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c32ea218a7aca7c8c3904554e730f601
SHA1 ad17056bddfc1aeb91b905edc992499d2668b243
SHA256 d6c325c36db46c43ca1e152426105c84906c04e222df39161c3a33b450601cf6
SHA512 e81e1e959a06f28835d5609c0fc5db297d2b231b082febd70ae02ca81571e1297bac4e1b9cdb1327986808940312c05e08e16682a2e628c49f2da5c6d775e7fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d2b44410a179bf87974334bcb6c9705
SHA1 d4c3584289fb12e5c0848d99040db9a16dd1bad3
SHA256 a7461bcb3e84da10000afbd64584e8f3f2ce7dc8b13c5df25b687a1ac9cf28f0
SHA512 8f98b2e53d23b941ed90eda8763c3cb2a79012a2f1bfb8c9f9ae267985a436b3dff4ca9c15154a711cedc9dfc3e1cf3b568edcb1536fd10f9625c580ae9c2f00

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 630ce8098c12bc97bc78cd1fc0ac1741
SHA1 d08ba7dc837eba175ba39b058c1825417a09e0df
SHA256 a566dfc6a52ee0c979d1d3cac7bf3094a23dc7e011b69aacd240262d9eb7a367
SHA512 e16a4b8d77cc067d3b1e00bce80e0c01d5aed38d9ec9beed3a75cd44211e5aaa5245f6676006dd7ee4e53851471b2b4dad855bc1dc7b2f305424abe031bcb2c0

C:\Users\Admin\AppData\Local\Temp\tmpBB73.tmp.bat

MD5 f1e45f45850cb3f942b7fd089bed66a1
SHA1 109d96998edd41f76a8ab41570df3aebebbf404b
SHA256 060da637d008983be0c8c30d86166500d982113ab1d6dab1721d4778b0ff19f4
SHA512 60f8bf18f425df60935e68280b6f8a5eb8ad63f8931061c92feeb5581ad07a88d70a3358643b3dedb6964d2012d67235fc7649ad15df78888e0404d847d14916

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 048cbaa33b8e9a0659ee99bd3579913d
SHA1 c44669ae4546c92304641ae3b16a073832d3feaf
SHA256 2ddaf19b91dfbec886be16016837fff01d2d3c32f9bfcd1f6e499dcb37e4644a
SHA512 0fcbc80cb6b0de150f42f72373f5a057c753dbb254b522a29a27fce618d5d784bd7b6367da490c86b6076124259e54b7576118087ba48404e9e874d64d7d809e

memory/2240-835-0x000007FEF5250000-0x000007FEF5C3C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dcb6d1689a0bdc89a1ea2fa45d242a34
SHA1 ffa0a3b2ffdcf1ed0bebd66781c2ccb06bcf81d3
SHA256 9bb14670d8009b4236e5afbb3007b84463057de6a2dd986e8354009f07225ccb
SHA512 f85c0a4dceeffa24f8928d06869ef98df4827700a8fe7561f6b69ff1657c9fce50994fdb55ae3f20a749d21989592547e5b9b86637edc41f4968f3ba61b27a5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c033301bce3cdbdc60f20bdaf450eae
SHA1 ef717f6c1c25d6387ccb8d35db0f748a00dd6339
SHA256 f0e2b25c772a43a8ef51fc2b653bc794ac79ac7825f8707390aec5a573092b23
SHA512 daca1d04f8a40f16b48070cd25bac429740036b0ffa5eb2306006e0a1faf36c5ed72850d07b5c2093c70ba528f78bd8b0de84dfe7218e3d4b447a5cfc0133285

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa6fc7afce4d423c85c12eec0a63c519
SHA1 450a81c494fb22c88b65c4b19fb337e1b0590f92
SHA256 cfec3e18ca9760282aa2142835183913740a39aeb6f78e8ff323c87db5a6a1b2
SHA512 3b1b2b6929aecdcdece86e3d981b4ba046da6d279654c2cb94b090da115a0b5b580d95aab4fa67d95530460cf8e08879085e64f2fae9632371b66e8448c6776c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e9891a2a54df2f4fc6f73bf6b12838e1
SHA1 16b021790e131096209db9ca054667a981b60bf2
SHA256 c8217ac6d364d568bef0a6c95d8d3afae8a9c82bcf4819449ad57af4e955dcb2
SHA512 a5df62c05b95ec82069afe3c129afa725b4159c8e81fa1d77bcf58bf346380286b31bfed40fc13ef79bbe876af8e792cd7554166e1d20113423b6dbc691b29cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 503288783facb2b3e26b9a41bca88fb9
SHA1 d14ad2461c1007039612656ebef47761130b06a7
SHA256 1b806ec779147b13351744ffff75936a6a57cedaac09cf22a4262e4d0e76b0cb
SHA512 fb6942e639be460a4e1d3acdcaf1b926a03cc317318b3dba885c465edd57df39af4494592995dad1919d0670b127cea9e42f862aad9a4f93731bb136be7b3195

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cedb1a88fc705b4ff3c66be520d37de8
SHA1 e1d2f0a94fbf7aa01251400c3c700a1970505005
SHA256 8944c17db947637c5183cdaeae368f16eea2c464d39541d016f240192dacffe4
SHA512 525b328d98b785778bd279a679196f7e638cee9980f3a1692eb5821c67737c209ee7f9145a264dc4c36094c52597ecd13583b74542c3e2a87b83cbb72cd43725

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 22:24

Reported

2024-06-08 22:28

Platform

win10v2004-20240226-en

Max time kernel

91s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Funny.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\program N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\program = "C:\\ProgramData\\program" C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\program N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3932 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 3932 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Windows\System32\schtasks.exe
PID 3932 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3932 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\Funny.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Funny.exe

"C:\Users\Admin\AppData\Local\Temp\Funny.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Funny.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Funny.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\program'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'program'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "program" /tr "C:\ProgramData\program"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5044 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5760 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5544 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:1

C:\Windows\system32\werfault.exe

werfault.exe /h /shared Global\ea37472b7ea04d4b88b57381d4173427 /t 2824 /p 4236

C:\ProgramData\program

C:\ProgramData\program

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 by-mit.gl.at.ply.gg udp
US 147.185.221.20:3500 by-mit.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.17.251.4:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:443 www.microsoft.com tcp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 4.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 219.83.221.88.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.189.173.20:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 20.173.189.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/3932-0-0x00007FFC8CBB3000-0x00007FFC8CBB5000-memory.dmp

memory/3932-1-0x0000000000220000-0x0000000000230000-memory.dmp

memory/3932-2-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-3-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-4-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-12-0x000001BA41FF0000-0x000001BA42012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bxcw3il.swf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1160-15-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-16-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-17-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/1160-20-0x000001BA42190000-0x000001BA422DE000-memory.dmp

memory/1160-21-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

memory/960-34-0x0000021DE5F80000-0x0000021DE60CE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 be67063c62a242565760a02a642a9f02
SHA1 d1043a892b44d6676f71b568f578fff947266a19
SHA256 56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48
SHA512 90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

memory/2164-46-0x00000177FDDB0000-0x00000177FDEFE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 50d3033f2bc3a3774c469d03e71a79a9
SHA1 22027b1d52085de99b3bffa276530fea5d961471
SHA256 2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147
SHA512 ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

memory/2964-58-0x000002A3F9EC0000-0x000002A3FA00E000-memory.dmp

memory/3932-62-0x00007FFC8CBB3000-0x00007FFC8CBB5000-memory.dmp

memory/3932-63-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp

memory/3932-64-0x000000001BF50000-0x000000001BF5C000-memory.dmp

C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

MD5 d012e5555ae6936cbe76b0edf9b0da69
SHA1 0a80fe68cdd19432d8f4ccae4b505613064f1966
SHA256 7a35c4144ba71bf57b0fe01b116314ff31f3765cd6667c3d48def6fe1c4af861
SHA512 920b93ad09eddab8b03be79bc8813abce6beaa0cbb37ff0a8d85c92c8940ce003bb03d967eaa84d22b01e00aabfab26e16c2d41fb2c56bd60bf08171cb130de6

C:\ProgramData\program

MD5 90fc7afe1b516a9fa685089ae0f5f322
SHA1 94ee6cb901f16a3136607c0e194c1e76b5ac76d8
SHA256 a53ea993bd31a24b3620978a84164bba38f592eb01f4d4cfe9bc4ae1af99c4a4
SHA512 e3f5d77e6da170460d9bfa3273608397f3fb0bc98eb34ed1729c357681d449a443e54abf75259efceca98c1527e0ed6201154556a1e889b11901a1b53fb5f2c9