Malware Analysis Report

2024-09-11 14:53

Sample ID 240608-ztnz8aha25
Target 2 лдшуте.exe
SHA256 a4ee1f41eada056a3c1802839d549de40fdbd7995a5940a8f7cb9fb9785b0e87
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a4ee1f41eada056a3c1802839d549de40fdbd7995a5940a8f7cb9fb9785b0e87

Threat Level: Known bad

The file 2 лдшуте.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Detect Xworm Payload

Xworm

Xworm family

Command and Scripting Interpreter: PowerShell

Drops startup file

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-08 21:00

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 21:00

Reported

2024-06-08 21:09

Platform

win7-20240221-en

Max time kernel

147s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\system N/A
N/A N/A C:\Users\Admin\AppData\Roaming\system N/A
N/A N/A C:\Users\Admin\AppData\Roaming\system N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\system" C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\schtasks.exe
PID 2684 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\schtasks.exe
PID 2684 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\schtasks.exe
PID 2804 wrote to memory of 1228 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 1228 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 1228 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2196 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2196 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system
PID 2804 wrote to memory of 2196 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\system

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe

"C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2 лдшуте.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\system'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\AppData\Roaming\system"

C:\Windows\system32\taskeng.exe

taskeng.exe {26402487-3F77-42E8-B845-1101BD5D0181} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 word-belize.gl.at.ply.gg udp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp

Files

memory/2684-1-0x00000000010A0000-0x00000000010BA000-memory.dmp

memory/2684-0-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

memory/2684-2-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

memory/2528-7-0x000000001B370000-0x000000001B652000-memory.dmp

memory/2528-8-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZYVOCEIJDTDNLY4N8D3L.temp

MD5 5473e95f5a3ac54c33ec0b81e729de29
SHA1 16f540afbe75f5aea9f7991aa00e1e84fe1e1c8e
SHA256 139b0e7509c92b80c60d7680d55cb4165351c360a6bf257f4bbef9237f4e8123
SHA512 90afb64651fc81eb458a8d424037296803fa88b7222ae0ae7ed6be10e3667bec37a2ff0d41d24f3785aa63caaf8538eca22fdd6d6b615d27a31a32faa00012dd

memory/2548-14-0x000000001B350000-0x000000001B632000-memory.dmp

memory/2548-15-0x0000000002010000-0x0000000002018000-memory.dmp

C:\Users\Admin\AppData\Roaming\system

MD5 632ab73920e2e8e8100d927ab00e12a5
SHA1 4676f206bb580f87589bb2e1cfa0270959534ae6
SHA256 a4ee1f41eada056a3c1802839d549de40fdbd7995a5940a8f7cb9fb9785b0e87
SHA512 21df86d3316712979b995844516bb12f86823cb96977e52c05b9b855aece6c9917ffee31d5ba4d415babc8290fa2a364ba3cb501b5724208676d077469a829db

memory/1228-33-0x0000000000E50000-0x0000000000E6A000-memory.dmp

memory/2684-29-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

memory/2684-34-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

memory/2196-38-0x0000000000080000-0x000000000009A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 21:00

Reported

2024-06-08 21:09

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\system N/A
N/A N/A C:\Users\Admin\AppData\Roaming\system N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\system" C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\schtasks.exe
PID 4832 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe

"C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2 лдшуте.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2 лдшуте.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\system'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\AppData\Roaming\system"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Roaming\system

C:\Users\Admin\AppData\Roaming\system

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 word-belize.gl.at.ply.gg udp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 147.185.221.20:1678 word-belize.gl.at.ply.gg tcp

Files

memory/4832-0-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

memory/4832-1-0x0000000000250000-0x000000000026A000-memory.dmp

memory/4832-2-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/980-3-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/980-4-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/980-14-0x0000023B79320000-0x0000023B79342000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y44pflv2.ld1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/980-15-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/4832-16-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

memory/980-17-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/980-20-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 797854a243216a8151b7bf335394c53f
SHA1 e9963ea0aece462daae4a6ff2f9525268c7ff1c4
SHA256 49c312b5bb740271b4fb126505bd4a806bda1afd7bc848d9023ef266a9d2c9b8
SHA512 90e2ab3a579c387d4bd239a487994fc743fe358419b561ef2ae1cdedbedce534aa4806bdec4b97e0ef5439134014adaa9549560d3af58f7ce542564d0069d8ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c08aea9c78561a5f00398a723fdf2925
SHA1 2c880cbb5d02169a86bb9517ce2a0184cb177c6e
SHA256 63d2688b92da4d1bb69980b7998b9be1595dd9e53951434a9414d019c4f825a7
SHA512 d30db2f55bbda7102ffe90520d233355633313dcc77cdb69a26fdbb56e59dd41793def23d69dc5dc3f94c5bd41d3c26b3628886fd2edbed2df0b332e9a21f95c

memory/4832-58-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

C:\Users\Admin\AppData\Roaming\system

MD5 632ab73920e2e8e8100d927ab00e12a5
SHA1 4676f206bb580f87589bb2e1cfa0270959534ae6
SHA256 a4ee1f41eada056a3c1802839d549de40fdbd7995a5940a8f7cb9fb9785b0e87
SHA512 21df86d3316712979b995844516bb12f86823cb96977e52c05b9b855aece6c9917ffee31d5ba4d415babc8290fa2a364ba3cb501b5724208676d077469a829db

memory/4020-63-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-65-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-64-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-72-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-75-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-74-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-73-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-71-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-70-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

memory/4020-69-0x000001BC71C00000-0x000001BC71C01000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk

MD5 94c04159c0c4810f269fbe6175b25a42
SHA1 42ed79ca4dfba414b615292692ea3fd50d9534bb
SHA256 89faaa39382631a7a939b4d27f8e9983f5dad13b863b87dc9a4e1eb7ce6936e6
SHA512 eaff3529e09298a17be5fbb7281e0f5d6651af5cfe1fded29de5888001511d9a301d8bafc210303643e7f97e9ded14d0ab8bfa128ec282e37d1981039b71c53a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\system.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1