xworm | db77279f6b996ae07ac5fd3b1edb3ecf9525087c96bbcf2d7a2a4c100db2cc7b

Analysis

max time kernel
46s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord.exe
Size 37KB
Sample240622-hmepja1cmc
SHA256 db77279f6b996ae07ac5fd3b1edb3ecf9525087c96bbcf2d7a2a4c100db2cc7b
MD5 5c68aeb4a851c6e926ead1ff59f90640
SHA1 43771d2ff223f80c51a4907786037e746160d0fc
SHA512 074e91d484a5fbcac50f947a5c2daea247ba57f3ebdf93381d7710aa5e29f7a123fda2147764880f681694fb2cc2e86c2ef5a0fef638a2fe7db0c73104bb8172
SSDEEP 768:OEVqIZbwCxWaAXFyw9OY+v6sO/hKPSKAxC:O8qIZb9xKFP9h+6sO/MvAU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

147.185.221.20:33255

Mutex

L38G3mo1mQdyxT1M

Attributes

Install_directory
%Public%
install_file
Discord.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1812-1-0x0000000000260000-0x0000000000270000-memory.dmp	family_xworm
behavioral1/files/0x000e0000000233e5-116.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe
4688	powershell.exe
2356	powershell.exe
1856	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 1 IoCs

pid	Process
724	Discord.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Public\\Discord.exe"	Discord.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635126980585823"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
2504	powershell.exe
2504	powershell.exe
2504	powershell.exe
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	Discord.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeDebugPrivilege	1812	Discord.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeDebugPrivilege	724	Discord.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3344	4472	chrome.exe	84
PID 4472 wrote to memory of 3344	4472	chrome.exe	84
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2040	4472	chrome.exe	86
PID 4472 wrote to memory of 2104	4472	chrome.exe	87
PID 4472 wrote to memory of 2104	4472	chrome.exe	87
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88
PID 4472 wrote to memory of 1008	4472	chrome.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Discord.exe
"C:\Users\Admin\AppData\Local\Temp\Discord.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Discord.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\Users\Public\Discord.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0x8c,0x108,0x7ff9008dab58,0x7ff9008dab68,0x7ff9008dab78
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=556 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2116 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4308 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4860 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4220 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4728 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4692 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3156 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3188 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3228 --field-trial-handle=1896,i,7475602516137002873,11707444049827913651,131072 /prefetch:1
  2⤵
  PID:876

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1572

C:\Users\Public\Discord.exe
C:\Users\Public\Discord.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 f3ca7f30960f22ff8a9f335731ac9df4caf1b66b962bd3b31f0902c126a43e1f
MD5 1fd8b2d2fc77ed9e11f48926b964fcd1
SHA1 737864485bf91d1b7f33b85ff3e3644cf4d9a267
SHA512 64f09e5010efe37690390067202cf6eaa070a56df5b054cf645ba28673d424d5e6639cfe47ca9042fbacf08c5ed66253018c318ada7a7cea3bf1ff88ffad00e7
SSDEEP 192:/do6pOjAE8aJo8syh+FC6sP5tjEsXtScR:/do6rgCyqFEtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 1103f66ed2cb6df69eba68e3d0b790e57c9dba11430858cd5075264a7706aa5b
MD5 eb5103de8d258f44db27d69968ff05ad
SHA1 2865a5614c0e119893dce1fc80cab8e147090b76
SHA512 d3bc3b4022c36beab113b3d8543cb78b488210ea07f659769a5b834187b0852169b083dfd9d388f3aad2ccc4273423e479913ffba60d83bcc07968baa6a29660
SSDEEP 6144:uhZ5IZXqXHjTdCP3y/qQYRPILxZnhLMJjX0EeGzY2rLF:isqlGSqQ5fnReEFsLLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 25f1be9f4359e1871b6777428369054cb8834bc7bfe31312654d63d05c6740cf
MD5 244fdadace5a8ab3451452614db4678b
SHA1 11f21956754fa78aede60f28d47cb25c81e53a13
SHA512 ad09d076fdaeda596bfe771001c1982ee423f09a770c81070d9962ba9f526d305b08356aff11a51d1cf1fb47ed722f0a6cfa25922d22b437a22e959cf43617c3
SSDEEP 6144:uGZ5IZXqXHjTdCP3y//QYRPILxZnhLMJjX0EeGzY2rLF:/sqlGS/Q5fnReEFsLLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 fb85d712210037e1bc1660883040b08fc657899aeee0ebcd27da2ad4f14cb31c
MD5 7517105ce60d045609d2c5d8025eb4cb
SHA1 dc78e319ca9a5b26ff4db10d186350d98afd4c2a
SHA512 ad9a150a921bbeb263bf6e9e2f3985c03ee8f5ed6238c6c8d8cde27c72cf0951be471cff7433e5c8c68e7e14ef6ddc6f01b3f4a2037ae077136fc9a3d81ac565
SSDEEP 384:2WdaxEQXueaeI+R7zBD0Hg6Fp2+X5GEEMAVA/Ag6oZjnbvmruoM6xpn+8g+zT7XR:eiQy/OCnOYMP8iBqKR+R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe580124.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580124.TMP
Size 88KB
SHA256 b773a04e98e248161109ad41e1427d3fc594364112b9894bf2c0249437cc68f7
MD5 02d24cd3a436b69b0bd84c0863062ea9
SHA1 5583aed94a8f8f509bcd77ca7ce8e5cfedc4d667
SHA512 9e906e1e914d489fe545f783de7428703023cd3beb942d65f9bbe853f77b6848f7d0aff4a3dbc5ec051f1164328405eb1338d36aecbd64229adc3f54f9475728
SSDEEP 384:QWdaxEQXueaeI+R7zBD0Hg6Fp2+X5GEENVA/Ag6oZjnbvmruoM6x1+8g+zT7Xs2z:YiQy/O8nOYMP8iBqKR+Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
MD5 ef72c47dbfaae0b9b0d09f22ad4afe20
SHA1 5357f66ba69b89440b99d4273b74221670129338
SHA512 7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
MD5 da5c82b0e070047f7377042d08093ff4
SHA1 89d05987cd60828cca516c5c40c18935c35e8bd3
SHA512 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fma2ug1r.2vu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fma2ug1r.2vu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Discord.exe

Path C:\Users\Public\Discord.exe
Size 37KB
SHA256 db77279f6b996ae07ac5fd3b1edb3ecf9525087c96bbcf2d7a2a4c100db2cc7b
MD5 5c68aeb4a851c6e926ead1ff59f90640
SHA1 43771d2ff223f80c51a4907786037e746160d0fc
SHA512 074e91d484a5fbcac50f947a5c2daea247ba57f3ebdf93381d7710aa5e29f7a123fda2147764880f681694fb2cc2e86c2ef5a0fef638a2fe7db0c73104bb8172
SSDEEP 768:OEVqIZbwCxWaAXFyw9OY+v6sO/hKPSKAxC:O8qIZb9xKFP9h+6sO/MvAU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1812-105-0x00007FF9036E3000-0x00007FF9036E5000-memory.dmp

Download

memory/1812-0-0x00007FF9036E3000-0x00007FF9036E5000-memory.dmp

Download

memory/1812-107-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/1812-3-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/1812-1-0x0000000000260000-0x0000000000270000-memory.dmp

Download

memory/2504-52-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/2504-68-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/2504-63-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/2504-51-0x000001A2F6820000-0x000001A2F6842000-memory.dmp

Download

memory/2504-62-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download