Malware Analysis Report

2024-09-23 03:36

Sample ID 240625-p7d23atgqn
Target Nursultan NextGen Crack.exe
SHA256 e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11

Threat Level: Known bad

The file Nursultan NextGen Crack.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Kills process with taskkill

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-25 12:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 12:57

Reported

2024-06-25 13:00

Platform

win7-20240611-en

Max time kernel

109s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\wininit N/A
N/A N/A C:\Users\Admin\wininit N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 2232 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 2232 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 2232 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 2232 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 2232 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 2072 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2072 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2072 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2072 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 2072 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 2072 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 2360 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2360 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2360 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 960 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 960 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 960 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 960 wrote to memory of 908 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 960 wrote to memory of 908 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 960 wrote to memory of 908 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2360 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\system32\shutdown.exe
PID 2360 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\system32\shutdown.exe
PID 2360 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\system32\shutdown.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\choice.exe

choice /c 12 /n /m "Enter your choice:"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"

C:\Windows\system32\taskeng.exe

taskeng.exe {1D5D0E0A-7200-42E5-BEA6-BB2924437CF9} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\shutdown.exe

shutdown.exe /f /s /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 seems-poet.gl.at.ply.gg udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp

Files

memory/2232-0-0x000007FEF5363000-0x000007FEF5364000-memory.dmp

memory/2232-1-0x0000000001250000-0x000000000128A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

MD5 a9aee64b701db5f8cfc3c963872403b4
SHA1 48079f6822d84ea354f301cdb97d2ecb59552e06
SHA256 f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb
SHA512 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e

C:\Users\Admin\AppData\Roaming\и.bat

MD5 9885bc1f632421f329efe28818361344
SHA1 9d0838fa885728361703a6e2b36e2aa3603b05ce
SHA256 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a
SHA512 ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203

memory/2360-15-0x00000000011E0000-0x0000000001206000-memory.dmp

memory/2360-17-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

memory/2712-22-0x000000001B360000-0x000000001B642000-memory.dmp

memory/2712-23-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 d701ae41c303c3cea0fd2040128f2fc2
SHA1 56a990d4a5f97a3f04507bb96e7dec951c437472
SHA256 661aace1143c2edeec82d28f5dbba2c53ae4b7a583fa3ce7da49cf67da5930b5
SHA512 9e2f3abe04ac9ec3a8c25bddda1873a0baa007bfe6a24b95934b7837b0c8e7854307af6e217556de07060045588970d3ebc009fab7729f6a48a3a141be921405

memory/2632-29-0x000000001B240000-0x000000001B522000-memory.dmp

memory/2632-30-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

memory/2360-42-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

memory/2360-47-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

memory/2360-48-0x0000000001110000-0x000000000111C000-memory.dmp

memory/956-52-0x0000000000F90000-0x0000000000FB6000-memory.dmp

memory/2360-53-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

memory/2360-55-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 12:57

Reported

2024-06-25 12:59

Platform

win10v2004-20240611-en

Max time kernel

84s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\wininit N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4044 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 4044 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 4044 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 4044 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 4008 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4008 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4008 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 4008 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 4640 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 4640 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2972 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2972 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2972 wrote to memory of 4108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 2972 wrote to memory of 4108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 4640 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\taskkill.exe
PID 4640 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\taskkill.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\choice.exe

choice /c 12 /n /m "Enter your choice:"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\choice.exe

choice /c 12 /n /m "Enter your choice:"

C:\Windows\SYSTEM32\taskkill.exe

taskkill /F /IM explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 seems-poet.gl.at.ply.gg udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp

Files

memory/4044-0-0x00007FFDE86B3000-0x00007FFDE86B5000-memory.dmp

memory/4044-1-0x0000000000020000-0x000000000005A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

MD5 a9aee64b701db5f8cfc3c963872403b4
SHA1 48079f6822d84ea354f301cdb97d2ecb59552e06
SHA256 f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb
SHA512 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e

memory/4640-17-0x0000000000FB0000-0x0000000000FD6000-memory.dmp

C:\Users\Admin\AppData\Roaming\и.bat

MD5 9885bc1f632421f329efe28818361344
SHA1 9d0838fa885728361703a6e2b36e2aa3603b05ce
SHA256 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a
SHA512 ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203

memory/4640-19-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

memory/4612-20-0x000001F7EC310000-0x000001F7EC332000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4hzztc4.2mp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1dc2f315ce03fd8f568e1c688977af5b
SHA1 e24b428c5153ce5958db1ed999be0c7a9c3d97a4
SHA256 d3e0de9b58edce0a38f19db0a90791951644ae10baf52e8a7d1cf9065fd903a4
SHA512 9572182b58c57fdfab9a33d84bf013977fcbc0ed28bc4b3a1f102dcd5b709cf1865f5975086f5e3aa305f674f456eef66dca94615997648b4db03e356e8bed54

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

memory/4640-67-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

memory/4640-68-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

memory/4640-69-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

memory/2356-75-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-77-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-76-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-87-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-86-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-85-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-84-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-83-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-82-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/2356-81-0x000001FB6CF50000-0x000001FB6CF51000-memory.dmp

memory/4640-89-0x00000000017E0000-0x00000000017EA000-memory.dmp