agenttesla | e407a948340cdfcd470f25d6a891864e2aea65f06d007cc9d7bd4893b0682319

Analysis

max time kernel
117s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm-V5.6.rar
Size

20.9MB
MD5

fdbb726bb80ec771b3296a715153d518
SHA1

818f734ecfa2b86d06d0154db2aeb3ace92b2283
SHA256

e407a948340cdfcd470f25d6a891864e2aea65f06d007cc9d7bd4893b0682319
SHA512

b6f79f8e3182113efb6c8fb246f3bf149991a7e2255d6417d19dd478e681c08d8c3ad97d500a43609eb0dbcf5777daf58df5920e00aa40c516d5b1e46f8b3608
SSDEEP

393216:PV10n8N0/c2lDGdlMVSGpomu8u5E/ZsiLh5UirAxl9YVjxWiqcrOsb:PQn8N002A6IGS5E/RTrA89WiX9b

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000002348a-354.dat	family_agenttesla
behavioral1/memory/5544-355-0x000001F5380A0000-0x000001F538294000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
5544	Xworm V5.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3224	OpenWith.exe
5544	Xworm V5.6.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	firefox.exe
Token: SeDebugPrivilege	3428	firefox.exe
Token: SeDebugPrivilege	3428	firefox.exe
Token: SeRestorePrivilege	2592	7zG.exe
Token: 35	2592	7zG.exe
Token: SeSecurityPrivilege	2592	7zG.exe
Token: SeSecurityPrivilege	2592	7zG.exe
Token: 33	5988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5988	AUDIODG.EXE
Token: SeDebugPrivilege	2492	taskmgr.exe
Token: SeSystemProfilePrivilege	2492	taskmgr.exe
Token: SeCreateGlobalPrivilege	2492	taskmgr.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3428	firefox.exe
3428	firefox.exe
3428	firefox.exe
3428	firefox.exe
2592	7zG.exe
5544	Xworm V5.6.exe
5544	Xworm V5.6.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3428	firefox.exe
3428	firefox.exe
3428	firefox.exe
5544	Xworm V5.6.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe
2492	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe
3224	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3388	3224	OpenWith.exe	95
PID 3224 wrote to memory of 3388	3224	OpenWith.exe	95
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3388 wrote to memory of 3428	3388	firefox.exe	97
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 3884	3428	firefox.exe	98
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100
PID 3428 wrote to memory of 2244	3428	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6.rar
1⤵
- Modifies registry class
PID:956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6.rar
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.0.2048677237\1717247376" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d39f5fa0-1eb1-43a6-88ab-bec414e1bd33} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 1868 248c700f058 gpu
      4⤵
      PID:3884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.1.399993185\1841222948" -parentBuildID 20230214051806 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a6983a2-799d-4a45-88c5-89e88c24346b} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 2460 248ba38a658 socket
      4⤵
      Checks processor information in registry
      PID:2244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.2.999935552\60140326" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2996 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {714c2053-2595-4433-808d-6aa6aec4f53c} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 2948 248c9646b58 tab
      4⤵
      PID:1352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.3.553338897\1871941412" -childID 2 -isForBrowser -prefsHandle 4044 -prefMapHandle 4040 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a481b0a-0a9f-4e9b-b3f8-dbed6cf6a166} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 4052 248cb49ab58 tab
      4⤵
      PID:2984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.4.694392122\663392515" -childID 3 -isForBrowser -prefsHandle 5048 -prefMapHandle 5232 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ff32eb0-a367-4c03-aa45-8358f7cb79d4} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 5096 248cc236658 tab
      4⤵
      PID:3156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.5.1218975754\773689848" -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5516 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d09c383-5543-401f-9626-c17187b440c1} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 5436 248ce45ef58 tab
      4⤵
      PID:636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3428.6.1962408888\1849077775" -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5700 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0255705-ef50-4c17-b6d3-be0bfe4aad81} 3428 "\\.\pipe\gecko-crash-server-pipe.3428" 5712 248ce45f258 tab
      4⤵
      PID:4180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Xworm-V5.6\" -spe -an -ai#7zMap14214:82:7zEvent26192
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2592

C:\Users\Admin\Downloads\Xworm-V5.6\Xworm V5.6.exe
"C:\Users\Admin\Downloads\Xworm-V5.6\Xworm V5.6.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5544

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5868

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x3f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jhlyxaos.default-release\activity-stream.discovery_stream.json.tmp

Filesize
27KB

MD5
dcba97c83b7f101ee8c5ece31050e517

SHA1
4bb6dad6373719928a7facfbfd94af355ad3bf45

SHA256
9e612e228ce19b9b137eb2e34895c8115149937fa578b341bc8d1234e63c5e24

SHA512
a2cc884fa3002cb94662ac60417090b960407741ad2cffb5d947a01d700c04d41db0e0f5e08a32b8c2424d9c994a1d384ac4abecdaa586d3f5ad17a024a029b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs-1.js

Filesize
7KB

MD5
2ebcdb5d13df4ec289b06ac8a78f2566

SHA1
cf962f83806e40fa7d420deb527a9ead3dcd7a7d

SHA256
32c8eb9b37a0e079bc565cf390d5c4e4e799004c40d8c0bf823f378fd3959963

SHA512
1b7b26a37a4420c23e4a999f5c00d316350f943b5d2b848f89c8005cf13892a9e6fddc9df78565dd42010c71bd93e1d53cd39eed5baf15a50fb79ef2d52fe1a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs-1.js

Filesize
7KB

MD5
dc890f7ec9a78e0818dc6c4ba4f63a08

SHA1
194778111aa86f3230b781bfedd0be3a6f9a5317

SHA256
f7f2a40f4afe3175f9f8d4914bc650a5f985d989e4cc185e03215d9ef8eb277d

SHA512
85aba0f4e928d1c3c8bc642bd556b82879042be588607792e5446943fbfed90ce9ca45328864ffe52739d5c8ed5afc86c47fd9ea9353beef7e16a60bef52a4d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs.js

Filesize
6KB

MD5
62badadfee9a6b43afe4a89c3495e066

SHA1
335726e1a6a6ea4e0900d5370ee00c9617e941d5

SHA256
f736d3694a1811259d9b3c3c766aef4d1b12a63416138c01a1a13bee68176a4a

SHA512
ee1e09790cdda1064666c0b0fed62db629704215259e7756b11dc00a646a6f475e7f1d8813cc420e4b48b0cf79f0f561548344796f11ffa806ef5c99d6fcabef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2fb95c56c38ab769d18256d40e727ae6

SHA1
836a6a1018424a3026d4b87a33a321728bdaf3dc

SHA256
196aebd4f4d4651756ddc69f4645b3fe2c8f8351c4f60f38a912920a0233b8ab

SHA512
21e0f723049673bcbdf35d91c5fae3c6f8fc57f5a3f82fc9282e9326945734772c90487f3433763e4ad3a163d602dbf081d57244ba6484bf1a186d9a44dadb91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\sessionstore.jsonlz4

Filesize
640B

MD5
cc4a5e9c444ca1689853aa9664395a4d

SHA1
1af1859aba38f3d85248f1e41499e0bcf885bf6b

SHA256
353d6dc73ed42c8d539de817d2fee3870decda61cf53a1850ad4180c38d6cc11

SHA512
585115943d7b6c26ed3524887a8008a49bd2ab399970a27ddd2e8b1c2aaf27d3f4ae99461789dd9bb8e73bb779d012e1c60bd8179fc6fbe957949009c1f2ed55

Download Submit
C:\Users\Admin\Downloads\3Jt5lp6j.rar.part

Filesize
20.9MB

MD5
fdbb726bb80ec771b3296a715153d518

SHA1
818f734ecfa2b86d06d0154db2aeb3ace92b2283

SHA256
e407a948340cdfcd470f25d6a891864e2aea65f06d007cc9d7bd4893b0682319

SHA512
b6f79f8e3182113efb6c8fb246f3bf149991a7e2255d6417d19dd478e681c08d8c3ad97d500a43609eb0dbcf5777daf58df5920e00aa40c516d5b1e46f8b3608

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\Downloads\Xworm-V5.6\Xworm V5.6.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
memory/2492-423-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-416-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-417-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-418-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-428-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-427-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-426-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-425-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-424-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/2492-422-0x00000211C4570000-0x00000211C4571000-memory.dmp

Filesize
4KB

Download
memory/5544-353-0x000001F51AA40000-0x000001F51B928000-memory.dmp

Filesize
14.9MB

Download
memory/5544-355-0x000001F5380A0000-0x000001F538294000-memory.dmp

Filesize
2.0MB

Download