Malware Analysis Report

2024-11-16 13:28

Sample ID 240621-d1yx4s1ejk
Target c3f26d18690f3fbdf70643c3eb07ac52.bin
SHA256 df6899275995a1100f0eb1663653331ad83784e780685c56c4dfb4e67bddbc0f
Tags
xworm evasion execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df6899275995a1100f0eb1663653331ad83784e780685c56c4dfb4e67bddbc0f

Threat Level: Known bad

The file c3f26d18690f3fbdf70643c3eb07ac52.bin was found to be: Known bad.

Malicious Activity Summary

xworm evasion execution persistence rat trojan

Windows security bypass

Xworm

Detect Xworm Payload

UAC bypass

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Command and Scripting Interpreter: PowerShell

Windows security modification

Loads dropped DLL

Checks computer location settings

Checks BIOS information in registry

Drops startup file

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Maps connected drives based on registry

Suspicious use of SetThreadContext

Enumerates physical storage devices

System policy modification

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-21 03:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 03:29

Reported

2024-06-21 03:31

Platform

win7-20240221-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Xworm

trojan rat xworm

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\System.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\System.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2860 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\system32\WerFault.exe
PID 2860 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\system32\WerFault.exe
PID 2860 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\system32\WerFault.exe
PID 2804 wrote to memory of 2296 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 2296 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 2296 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 2296 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe
PID 668 wrote to memory of 568 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\System.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe

"C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2860 -s 752

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {813BDB59-C090-442B-B890-8FB4829F4026} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\System.exe

C:\Users\Admin\AppData\Roaming\System.exe

C:\Users\Admin\AppData\Roaming\System.exe

C:\Users\Admin\AppData\Roaming\System.exe

Network

Country Destination Domain Proto
US 104.161.80.204:7733 tcp

Files

memory/2860-0-0x000007FEF5923000-0x000007FEF5924000-memory.dmp

memory/2860-1-0x0000000001190000-0x000000000119C000-memory.dmp

memory/2860-2-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

memory/2860-3-0x0000000000AA0000-0x0000000000B1C000-memory.dmp

memory/2604-8-0x0000000002C20000-0x0000000002CA0000-memory.dmp

memory/2604-9-0x000000001B670000-0x000000001B952000-memory.dmp

memory/2604-10-0x0000000002810000-0x0000000002818000-memory.dmp

memory/2804-15-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-21-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-20-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2804-17-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-13-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-11-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2804-22-0x0000000000400000-0x000000000042A000-memory.dmp

\Users\Admin\AppData\Roaming\System.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/2860-28-0x000007FEF5923000-0x000007FEF5924000-memory.dmp

memory/2860-29-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

memory/612-32-0x0000000000B60000-0x0000000000B6E000-memory.dmp

memory/612-33-0x00000000003B0000-0x00000000003D0000-memory.dmp

memory/568-36-0x00000000002E0000-0x00000000002EE000-memory.dmp

memory/568-37-0x0000000000310000-0x0000000000330000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 03:29

Reported

2024-06-21 03:31

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Xworm

trojan rat xworm

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\System.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\System.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5112 set thread context of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5112 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5112 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 5112 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 2184 wrote to memory of 3292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2184 wrote to memory of 3292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2184 wrote to memory of 3292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Windows\SysWOW64\schtasks.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe

"C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\aadf3698e4ec98b1fae321c2e2b4119f293faca1667d4eaf33a6718bef05b882.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"

C:\Users\Admin\AppData\Roaming\System.exe

C:\Users\Admin\AppData\Roaming\System.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\System.exe

C:\Users\Admin\AppData\Roaming\System.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 127.0.0.1:7733 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
N/A 127.0.0.1:7733 tcp
US 104.161.80.204:7733 tcp
US 8.8.8.8:53 204.80.161.104.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/5112-0-0x00007FFFD6DE3000-0x00007FFFD6DE5000-memory.dmp

memory/5112-1-0x0000017F60DF0000-0x0000017F60DFC000-memory.dmp

memory/5112-2-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/5112-3-0x0000017F629C0000-0x0000017F62A3C000-memory.dmp

memory/2184-4-0x0000000000400000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhvdnkwo.xww.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2744-11-0x000001A83E2B0000-0x000001A83E2D2000-memory.dmp

memory/2744-15-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2744-16-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2744-17-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2744-18-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2744-21-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2184-22-0x0000000005310000-0x00000000053AC000-memory.dmp

memory/5112-23-0x00007FFFD6DE0000-0x00007FFFD78A1000-memory.dmp

memory/2184-28-0x00000000062F0000-0x0000000006894000-memory.dmp

memory/2184-29-0x0000000006A40000-0x0000000006AD2000-memory.dmp

memory/2184-30-0x00000000069A0000-0x00000000069AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\System.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/3164-33-0x0000000000420000-0x000000000042E000-memory.dmp

memory/3164-34-0x0000000002770000-0x00000000027AC000-memory.dmp

memory/3164-35-0x0000000002740000-0x0000000002761000-memory.dmp

memory/2184-37-0x00000000058E0000-0x0000000005946000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.exe.log

MD5 8c0458bb9ea02d50565175e38d577e35
SHA1 f0b50702cd6470f3c17d637908f83212fdbdb2f2
SHA256 c578e86db701b9afa3626e804cf434f9d32272ff59fb32fa9a51835e5a148b53
SHA512 804a47494d9a462ffa6f39759480700ecbe5a7f3a15ec3a6330176ed9c04695d2684bf6bf85ab86286d52e7b727436d0bb2e8da96e20d47740b5ce3f856b5d0f

memory/1860-41-0x0000000001140000-0x0000000001161000-memory.dmp