Malware Analysis Report

2024-09-11 13:53

Sample ID 240615-nbrgvascjk
Target YandexMusic Cracked.exe
SHA256 61e0250d7585faa901f962413c54dcf8f3581d36b602dcabce648c3576b36b42
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

61e0250d7585faa901f962413c54dcf8f3581d36b602dcabce648c3576b36b42

Threat Level: Known bad

The file YandexMusic Cracked.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm family

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Drops startup file

Looks up external IP address via web service

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 11:13

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 11:13

Reported

2024-06-15 11:16

Platform

win7-20231129-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Svchost.exe N/A
N/A N/A C:\ProgramData\Svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\ProgramData\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB1324D1-2B08-11EF-8DE0-D691EE3F3902} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Svchost.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1688 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\schtasks.exe
PID 1688 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\schtasks.exe
PID 1688 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\schtasks.exe
PID 324 wrote to memory of 704 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 324 wrote to memory of 704 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 324 wrote to memory of 704 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 324 wrote to memory of 1280 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 324 wrote to memory of 1280 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 324 wrote to memory of 1280 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Svchost.exe
PID 1308 wrote to memory of 2832 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1308 wrote to memory of 2832 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1308 wrote to memory of 2832 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1308 wrote to memory of 2832 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YandexMusic Cracked.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Svchost" /tr "C:\ProgramData\Svchost.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {880A94AC-9578-4127-86B6-5C384A0A84B9} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\EditPing.TTS"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MeasureResume.M2TS"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MeasureResume.M2TS"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UninstallConnect.xht

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
N/A 127.0.0.1:23184 tcp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp
US 147.185.221.20:23184 may-transmit.gl.at.ply.gg tcp
US 8.8.8.8:53 www.microsoft.com udp
NL 23.62.61.194:80 www.bing.com tcp
NL 23.62.61.194:80 www.bing.com tcp

Files

memory/1688-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

memory/1688-1-0x0000000000E00000-0x0000000000E28000-memory.dmp

memory/1688-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

memory/2748-7-0x0000000002790000-0x0000000002810000-memory.dmp

memory/2748-8-0x000000001B610000-0x000000001B8F2000-memory.dmp

memory/2748-9-0x0000000002690000-0x0000000002698000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 516b19fea9d42e4e975a514e908d186f
SHA1 574d7cbd442ea55fa4937f33eb59d74b0675a0b3
SHA256 6499800694f0f24eda7e59796ae05ee8ee2a1570790ea7aef55ceb9f30fb6fe8
SHA512 3e38797d98473691deae20059a1b84eb0eb08520fa8073affc96f4a86e4f6479e7594e27e6ae691b6a75bd6f89eb7c8ca074e327886a13d417b8337e9c4abdb6

memory/1928-15-0x000000001B7A0000-0x000000001BA82000-memory.dmp

memory/1928-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

memory/1688-31-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

memory/1688-32-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

C:\ProgramData\Svchost.exe

MD5 6f343370d2bc92e052ae1828346e9078
SHA1 b3efaf4c1056573b072572fdbd4b97c1c8ed6a1f
SHA256 61e0250d7585faa901f962413c54dcf8f3581d36b602dcabce648c3576b36b42
SHA512 c559f7e319bad1342c38dc56d778171b0acd2e5a57d59721f4d8e65a3179032cba755caf81faf20c1b6c04ef1d1bfea2cf27aa542562cc5879b7faaa05d1a01e

memory/704-37-0x0000000000D60000-0x0000000000D88000-memory.dmp

memory/1280-39-0x00000000010C0000-0x00000000010E8000-memory.dmp

memory/2208-50-0x000000013F240000-0x000000013F338000-memory.dmp

memory/2208-51-0x000007FEF1040000-0x000007FEF1074000-memory.dmp

memory/2208-55-0x000007FEF0F90000-0x000007FEF0FA1000-memory.dmp

memory/2208-54-0x000007FEF1360000-0x000007FEF1377000-memory.dmp

memory/2208-53-0x000007FEF6040000-0x000007FEF6058000-memory.dmp

memory/2208-52-0x000007FEED4E0000-0x000007FEED794000-memory.dmp

memory/2104-56-0x000000013F240000-0x000000013F338000-memory.dmp

memory/2104-61-0x000007FEF0F90000-0x000007FEF0FA1000-memory.dmp

memory/2104-60-0x000007FEF1360000-0x000007FEF1377000-memory.dmp

memory/2104-59-0x000007FEF6040000-0x000007FEF6058000-memory.dmp

memory/2104-58-0x000007FEED4E0000-0x000007FEED794000-memory.dmp

memory/2104-57-0x000007FEF1040000-0x000007FEF1074000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4428.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ef15c7f3dc9045439a4f8033c456793
SHA1 40859d2acbbf37bd0fc57948a5bb58b8977d00e5
SHA256 72630e3510bd4293f439765c5e1adf735755c852c5288201bedd5c57af55cefe
SHA512 a799aa0dc830e06b7afb8f8294c90e61ddf498c54c9d49efc730ddd752817041803c2048a1c58a2df90f29347a385f31bf39176f878cadf4b363f5783b3f167b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 7af5cd3ed4e657ea74a44983459db26b
SHA1 f565c4df5e913cad62743710146a484aabfa789b
SHA256 1b3aacb0efe5a2e6f8c7ef3629fc43cefa8282aa404561c87431bae9748f97b8
SHA512 ae0adc980f1af7c97defe215922dff980a503a2161bfecd2566de55426ecd0029822f83dbbacffe19106ee364e4f43efbf7744a3b6a384c235d5938192339a80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3c0d5c49bc4a8e25534698e6461cfe3
SHA1 1788a8b784f17bbf1ac3988747c10e6d130969e8
SHA256 5023a2f170d19de8a6c77cad63d2ab7623dcae98ecd7e05ecac7cdade73e0d9e
SHA512 4d660c5eff7988e28b3198da9e764941f14ebe4e8e583a44a2f6690c41b290062487fe33847287fd87b34ced61595b937e5d8fba0b540c4e7107f34f8c935720

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c00b9289af6c3b742a9d52beee615d7
SHA1 9c62f95b2fa6b95db452a702fb738fad71ccedd3
SHA256 bb90e9e14179225984f839b6e18bed94436af5ab5d796e1752ae96cc73621bdc
SHA512 6187c8e8322b80fe5531edaa43374d219fb8d6d01f8c5a17e3c2a2da3d2a3a9d363caf01db498ae76cbdac5abd1e2c7b6002a6408854015b874db210c663df1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 44a8a15426c963ca712f847848740555
SHA1 f572340f788e44cd3500e429b3a6bd1fabf73896
SHA256 ec56537072d202ba589dec47a3bb91dbe953184a5141cb2093e0ff1e279ab6a3
SHA512 31774943a3f1443cfe0e52e1b530f8e2ca38755da249f9b5174fe0c64f46f1d9e3732a732c73e371f567ca20eff6e65a0560b62d0d1b308a8b26b22f3ecf9737

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 030f7fac59e737cf7dfcefc0a9e4eb33
SHA1 2f2341ec06bfb20ef3e4816689db800a40f6afe5
SHA256 232072add529de6bcff9d6d8febda98c737c1cfb57d048680d69fa7579145bd1
SHA512 4eb25844e9d7dc6f0a7cfeedc2698532a1e2a1b262ef8ae841073ca3faf74bda026f4d717ad9a5884d2c4416276af47387a6917afd6047c677ed8271cac840f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ea7188cd3d22b7fe34e107bf254883f
SHA1 e0a6cd25a74e20b095ecf7d6f79d269109a0e5ae
SHA256 16b9e825a1d253d9863da7e1f8b542699511e5eb14bc626705d96983937c3d49
SHA512 6dd871665c8ec1dd434216779daf7aa6acf0e59775b4326dfb33f8c6fd11679aefa4f9c2e8fd5107d97c84c587685fd11bb74a52dd937e6dcf700fe2383416e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 614aaf2f8543bcf2c9a951f7788454f2
SHA1 2c7fd1c6a0c4d20addd6d5539a8c1122939b6098
SHA256 9aeab0ee5fd635babfa1a3a606c8f823ac4d0dfc864111cb925fe1546f02659d
SHA512 82ac728b916963db06f3e2f1065e21e1ccb9180804dd953a1bd9eb0fccb29601daae4ab66fc27f8c1a4fb781f944f1be9066c0de23f22ebd6d903061a977d47e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06ffac8299abbda3f56089c8cf444324
SHA1 67fe02ef620b401b8f867b086082e9767873c0a5
SHA256 06e67e849a58b8a91a49614aabb42793188fce26ed42240abbf8d5ce120e5cf6
SHA512 8d97d9bd73c366b792aaed379bc7eb454f388800c7249e314d8beb4be2566553b1b07193f63fd39e35a4431ae72aaf05f296d2080832358ae5e13996aa392016

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 728a3498bcb0d1d9384b6d338b9d468c
SHA1 b48783b6e32659e78ad5ecfa581a13d954b8108e
SHA256 b8649a6fa4d2b768de485876be499b925cc52a4a3c22b9b7dede0d50e3864183
SHA512 39b0070cb8125020dd50c2625c774f593a0e00db43ccab1a8bb69d19af5eedf1fb9d5c700110dae818b61e8d749358e7138c7b3a358f20c9bfb3d35f66babd6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 899ea8037f6b55f9744a87af6e4e8694
SHA1 154b67543f96241aeb2b0425948f3b77b64fd4a5
SHA256 f00e848f5fa6c052fb07f1af1935db9aa601b28a74b833a81774a2c87fc25a24
SHA512 24918d1ef627501ba9afb49d003f82b1e8336985a548931bf23ad75e699b7ad3d0db94885d3236bb3a933e638b4339d1b376b6020dd08386ec7261d1fda6d4eb

memory/1968-527-0x000007FEF1360000-0x000007FEF1377000-memory.dmp

memory/1968-528-0x000007FEF0F90000-0x000007FEF0FA1000-memory.dmp

memory/1968-533-0x000007FEEED80000-0x000007FEEED9D000-memory.dmp

memory/1968-519-0x000007FEED4E0000-0x000007FEED794000-memory.dmp

memory/1968-536-0x000007FEEED20000-0x000007FEEED5F000-memory.dmp

memory/1968-535-0x000007FEED2E0000-0x000007FEED4E0000-memory.dmp

memory/1968-530-0x000007FEEEDA0000-0x000007FEEEDB1000-memory.dmp

memory/1968-526-0x000007FEF6040000-0x000007FEF6058000-memory.dmp

memory/1968-516-0x000000013F240000-0x000000013F338000-memory.dmp

memory/1968-518-0x000007FEF1040000-0x000007FEF1074000-memory.dmp

memory/1968-534-0x000007FEEED60000-0x000007FEEED71000-memory.dmp

memory/1968-529-0x000007FEEF0D0000-0x000007FEEF0E7000-memory.dmp

memory/1968-563-0x000007FEEECF0000-0x000007FEEED11000-memory.dmp

memory/1968-565-0x000007FEEECB0000-0x000007FEEECC1000-memory.dmp

memory/1968-569-0x000007FEEEC30000-0x000007FEEEC41000-memory.dmp

memory/1968-574-0x000007FEEEBC0000-0x000007FEEEBD1000-memory.dmp

memory/1968-584-0x000007FEFAF30000-0x000007FEFAF40000-memory.dmp

memory/1968-598-0x000007FEE9C00000-0x000007FEE9CC5000-memory.dmp

memory/1968-616-0x000007FEE9AA0000-0x000007FEE9B0D000-memory.dmp

memory/1968-617-0x000007FEE9920000-0x000007FEE9A98000-memory.dmp

memory/1968-615-0x000007FEE9B10000-0x000007FEE9B72000-memory.dmp

memory/1968-614-0x000007FEE9B80000-0x000007FEE9BF5000-memory.dmp

memory/1968-597-0x000007FEE9CD0000-0x000007FEE9CE6000-memory.dmp

memory/1968-596-0x000007FEE9CF0000-0x000007FEE9D01000-memory.dmp

memory/1968-585-0x000007FEE9D10000-0x000007FEE9D3F000-memory.dmp

memory/1968-583-0x000007FEE9D60000-0x000007FEE9D71000-memory.dmp

memory/1968-582-0x000007FEE9D80000-0x000007FEE9DA1000-memory.dmp

memory/1968-581-0x000007FEEE960000-0x000007FEEE972000-memory.dmp

memory/1968-580-0x000007FEEE980000-0x000007FEEE991000-memory.dmp

memory/1968-579-0x000007FEEE9A0000-0x000007FEEE9C3000-memory.dmp

memory/1968-578-0x000007FEEE9D0000-0x000007FEEE9E7000-memory.dmp

memory/1968-577-0x000007FEEE9F0000-0x000007FEEEA14000-memory.dmp

memory/1968-576-0x000007FEEEB90000-0x000007FEEEBB8000-memory.dmp

memory/1968-575-0x000007FEEEA40000-0x000007FEEEA96000-memory.dmp

memory/1968-573-0x000007FEEEAA0000-0x000007FEEEB0F000-memory.dmp

memory/1968-572-0x000007FEEEB10000-0x000007FEEEB77000-memory.dmp

memory/1968-537-0x000007FEEC230000-0x000007FEED2DB000-memory.dmp

memory/1968-571-0x000007FEEEBE0000-0x000007FEEEC10000-memory.dmp

memory/1968-570-0x000007FEEEC10000-0x000007FEEEC28000-memory.dmp

memory/1968-567-0x000007FEEEC70000-0x000007FEEEC81000-memory.dmp

memory/1968-566-0x000007FEEEC90000-0x000007FEEECA1000-memory.dmp

memory/1968-568-0x000007FEEEC50000-0x000007FEEEC6B000-memory.dmp

memory/1968-564-0x000007FEEECD0000-0x000007FEEECE8000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 11:13

Reported

2024-06-15 11:16

Platform

win10v2004-20240508-en

Max time kernel

135s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Svchost.exe N/A
N/A N/A C:\ProgramData\Svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\ProgramData\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Svchost.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\schtasks.exe
PID 2456 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\YandexMusic Cracked.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YandexMusic Cracked.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Svchost" /tr "C:\ProgramData\Svchost.exe"

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

C:\ProgramData\Svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
N/A 127.0.0.1:23184 tcp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp
N/A 127.0.0.1:23184 tcp
N/A 127.0.0.1:23184 tcp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp
N/A 127.0.0.1:23184 tcp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp
N/A 127.0.0.1:23184 tcp
N/A 127.0.0.1:23184 tcp
N/A 127.0.0.1:23184 tcp
US 8.8.8.8:53 may-transmit.gl.at.ply.gg udp

Files

memory/2456-1-0x0000000000680000-0x00000000006A8000-memory.dmp

memory/2456-0-0x00007FFF7CB13000-0x00007FFF7CB15000-memory.dmp

memory/2456-2-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4oxqujv.js2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2396-3-0x000001EF50360000-0x000001EF50382000-memory.dmp

memory/2396-13-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/2396-14-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/2396-17-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ce4540390cc4841c8973eb5a3e9f4f7d
SHA1 2293f30a6f4c9538bc5b06606c10a50ab4ecef8e
SHA256 e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105
SHA512 2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 67e8893616f805af2411e2f4a1411b2a
SHA1 39bf1e1a0ddf46ce7c136972120f512d92827dcd
SHA256 ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31
SHA512 164e911a9935e75c8be1a6ec3d31199a16ba2a1064da6c09d771b2a38dd7fddd142301ef55d67d90f306d3a454a1ce7b72e129ea42e44500b9b8c623a8d98b4d

memory/2456-56-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

C:\ProgramData\Svchost.exe

MD5 6f343370d2bc92e052ae1828346e9078
SHA1 b3efaf4c1056573b072572fdbd4b97c1c8ed6a1f
SHA256 61e0250d7585faa901f962413c54dcf8f3581d36b602dcabce648c3576b36b42
SHA512 c559f7e319bad1342c38dc56d778171b0acd2e5a57d59721f4d8e65a3179032cba755caf81faf20c1b6c04ef1d1bfea2cf27aa542562cc5879b7faaa05d1a01e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Svchost.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1