xworm | 6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df

Analysis

max time kernel
251s
max time network
256s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
XClient.exe
Size 283KB
Sample240808-md9krssdkn
SHA256 6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df
MD5 94d7570a4d6becf9ccccac918fc7a525
SHA1 8e9fa909a7f38b1f4481ee880340c96aa03a9a84
SHA512 d97b0b2c758e3288ffbacf1111b621f0530ad152830b17795a8734e4d30cd85c5578d94983f6668222028e45095582a05a41033df0bf1061fb18124fe7fa8e7f
SSDEEP 3072:c43Cklb4wOyopUd87kREhYyZxbHrR6Y7zjokEtNaaayMakxiJ+UZeQnjm9sjSwkm:bpbVoA8oKhsrx8iJZeQiWsVCA2aAN0F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

hard-tyler.gl.at.ply.gg:27490

Attributes

Install_directory
%Temp%
install_file
systemprocess.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral5/memory/4704-1-0x00000000005A0000-0x00000000005EC000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1248	powershell.exe
3824	powershell.exe
3520	powershell.exe
3540	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\systemprocess = "C:\\Users\\Admin\\AppData\\Local\\Temp\\systemprocess.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1248	powershell.exe
1248	powershell.exe
3824	powershell.exe
3824	powershell.exe
3520	powershell.exe
3520	powershell.exe
3540	powershell.exe
3540	powershell.exe
4704	XClient.exe
940	msedge.exe
940	msedge.exe
1216	msedge.exe
1216	msedge.exe
1036	msedge.exe
1036	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	XClient.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	4704	XClient.exe
Token: 33	1452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1452	AUDIODG.EXE
Token: SeShutdownPrivilege	1572	shutdown.exe
Token: SeRemoteShutdownPrivilege	1572	shutdown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1248	4704	XClient.exe	78
PID 4704 wrote to memory of 1248	4704	XClient.exe	78
PID 4704 wrote to memory of 3824	4704	XClient.exe	80
PID 4704 wrote to memory of 3824	4704	XClient.exe	80
PID 4704 wrote to memory of 3520	4704	XClient.exe	82
PID 4704 wrote to memory of 3520	4704	XClient.exe	82
PID 4704 wrote to memory of 3540	4704	XClient.exe	84
PID 4704 wrote to memory of 3540	4704	XClient.exe	84
PID 4704 wrote to memory of 1216	4704	XClient.exe	86
PID 4704 wrote to memory of 1216	4704	XClient.exe	86
PID 1216 wrote to memory of 3192	1216	msedge.exe	87
PID 1216 wrote to memory of 3192	1216	msedge.exe	87
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 940	1216	msedge.exe	89
PID 1216 wrote to memory of 940	1216	msedge.exe	89
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/serc
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed1a03cb8,0x7ffed1a03cc8,0x7ffed1a03cd8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4788 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:3560
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e855 /state1:0x41c64e6d
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2
MD5 5578283903c07cc737a43625e2cbb093
SHA1 f438ad2bef7125e928fcde43082a20457f5df159
SHA512 3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571
MD5 0487ced0fdfd8d7a8e717211fcd7d709
SHA1 598605311b8ef24b0a2ba2ccfedeecabe7fec901
SHA512 16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 1024KB
SHA256 5e21b684d1423fd501eccabed11d155887cd6a8a485161127cf2fa2d55406ba1
MD5 428ff1ac3ce2c4453eda8d22c4260b27
SHA1 7ac34f3fa075459aae5f00579adb0f8af66bcfda
SHA512 134d37f4509fa565d1d27fdfa3d2d1e86df5484aaffb2380df9453cf39807ef94a92f41d1bd6d50a63a3ea872b1d21dfc65cd088cbcb4416afcbfa1ab7eff77f
SSDEEP 24576:PDgojsI3d/QnCIr0nmFxbUg6g4/3YCLZSIGBl5z:r4IN/Qnv4g6l3DZSIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 1024KB
SHA256 e61bf27dc4f42d5e7183def20da8ec1cf29e7900a6c6b0ba42d12094b717e5f0
MD5 19756d5e06ee30af80bf8470522adc98
SHA1 45801241647406251978f133990b0e553fa2b26d
SHA512 5860d6417cf2b2d8ec726a1c71662d3ce578cdc5f45ea4e9fe3640c9c6b91c2f80bf7f2df69dc992491425925103dc4d7cea60448aadb4fbe7df4b20ba8e2043
SSDEEP 24576:9QGNdl6ekdqxlXfvbBSqJJ3CCeFiFCooMDhZRNGjxm5LsZTRQA:9DnLkMvtSgBgiIooMDhHNGk5wZT2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 64KB
SHA256 3fcdf72605db2a0d4dac079c7cfee8718a5b9ddc6d6cbd035c40334edba81d9e
MD5 5e48476ce79470b7c30fbfaeee85732f
SHA1 936735216ce36c698cf8753ac5a01de3b918e1e2
SHA512 d73fcdf2551f3b706807ebfcb98e38671f2953f9df7778407732c616a9a6beb4dad403fc5fba5ee8e00d3c19d9f9396d6c9295ef5122f6a6cb2902968425a5e1
SSDEEP 1536:8R44flMI1Swpt6oCDKFznb1ydErBDUGalPJ26PWDTX:8R5ft1S3oIIb1qErOnNPWDT
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 df597c36a15ff519aaddbe569a069403a8878422b9a1dd56734ad066daf3c302
MD5 18d46003afae10c03c96fb3e5b5fb072
SHA1 12af29e19b8edf1ac7882a19cdf5d0815dc9a592
SHA512 42dbd2a5353dce555bd496ce087342b54002d0d805328e8ac3192cfde5e6d7057af15f742671c8bea11e638d95001895301fdb84755a460b08a5b6c6198c043e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1a606729508baf39653a269bd1b5a287ed6d1c3223ff403981bbfe93402f98c6
MD5 0421b2f4b70f9a7f29260e00ecfee4c9
SHA1 2ef7ccd7e8a17f42efa6496552b494e6a9e1201e
SHA512 3413ad00b81444e1b06da69d157b19e9007ef60a1d5866d464fcd75178d03bac57a240f628fbf518f7a6a35e3a484eb6b769e7b6ea0486da27628f438a3db9df
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5f65131339e48ef8c0d87e2802205c6ce98bcd866997194aff4fb6fa06247d82
MD5 818b473c12505afd7fd2e332c7d6b9f1
SHA1 13438d1acf5c792abecba188a14acdc1975e3bea
SHA512 aa597fbf1ef1b9a56dd0205a8c75781c55aefefa7400cdacee67652a09ba595d9fc08fe282131752f781be95739211b2141bcce5abf11d03c017e11c328dc422
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6c3bdf5196f80771f86f60d34c705a2fc3fdcb9022b6f77efd8788b0614214e5
MD5 618c28a07e13240a9cbed08b723964b4
SHA1 5c2c59a86b3ba01bbb6b7e68e308e44f4ceadce3
SHA512 671b9e91c98e330ed613f19a03228db3af68925d9d0f6f8f37f3002c87e0179588fbb952bee7bce28bd42601bf5185fb8f2970d7532d6836db06cf06540f156a
SSDEEP 96:nZk3tDxm/LQYmtpOkfwSv0MoiVmdHImJW0WQyV+VpziX3wI3:nZk3twAPOkfv0MAIUWLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b9690c27a1b89dfc307548f43ddf1af7765cd076bd3f8cd32a12288d8a993528
MD5 d8be8635a816e2ff8d21933cfbe2b5b5
SHA1 78f64752ebb8f15d44f9b40846f94ac697f6765e
SHA512 1a1a30e4b5f0f690dd50daf362906b98f4301446f4c848cacca0dbdb89c8549e98795eb3b927af97b74405c50294530c081f2e5a4d25f6570bc91836e91b49ad
SSDEEP 96:nZk3tDxm/L9mtpOkfwSv0MoiVmdXuI1jIwJW0WQyV+VpAiX3wI3:nZk3twEPOkfv0MyuIhIGWLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f36bf10fb92c8aaa7a76ffd32a0b2225237b8596549a06fef02f45068b9f8cf8
MD5 6ea068351054f39fea17e17090997215
SHA1 4285c15a3f65dd9a849eca31d12a3267717e1609
SHA512 d15de37e2e32e91d631b3292e8db218952c0bcff8c1920608603143baf0ef14b9f9b06ef3e0c9007f0dc8f1ddaf2fe2ba3faa298942fe407a82be22f0009de0b
SSDEEP 96:nZk3tDxm/L6mtpOkfwSv0MoiVmdXuI1jIwJW0WQyV+VpAiX3wI3:nZk3twFPOkfv0MyuIhIGWLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 bbd12abcc5805c586c00353728d217c57344a36aa1d4b058bf737a77b6639bfa
MD5 384049da4fb2f108b093c578c25e4863
SHA1 d1aa2a51862432ff5ecec46de973714c37aac235
SHA512 3f549cc8a298e6be83fade3a03062b8adaec84a32c4ff95cdc70f41129bc1bd53956c64e32726278ac3568ce3e22f8b4d35ce454a1fd4418dc76f3f8ab2fafe5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59c75d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c75d.TMP
Size 204B
SHA256 a61835febd533978980e397828fc1593d5d8c3f38c0034a3e108e9909d4b9deb
MD5 3fd68ada01dd262c28a36e207a6a3e15
SHA1 b18f2ab721a850ced03c0785f623c90ef952d751
SHA512 8b71e51120f0eb600625fec462c9bfc24651a5b091959dae5b385537c6165d6a5016f5d21f8b08826eaa05385a8bf82214201b235d5dd701ff7eac90e83ebbce
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 08b036938b344d7dd42e4ab911320049931871e45b66e332f863df301911533c
MD5 90847be568eb8ea635212a62bff76ddf
SHA1 bf5ef292b818b49442c0581bdad114b7aa1dd389
SHA512 b284ad05d2416e86d4826233adb538fee707fa1dd22afd1ac3b71e5c7d7b52610b10df78d1376c6779f57e7178c4188e71fe21149f092072ca9d19a41c4eeea3
SSDEEP 192:HoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGsr8e2RUHX94R3nwX0dQQHO0A:f9iIxuERzA83h09RZxASG6iK+dQV0rK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1874d91173d8d07fefa7c8be3ace0a5bc1c683e425acc1c07b5da24b708c8c9c
MD5 0ce5bb374bbea4b5f24f16f5029839f7
SHA1 dcf2c83c6ffeb92fa4d328445192e13f987d346b
SHA512 5158901f87570a43c6b3a93cf9b3954318d0d0b7577e8d2855fce23da5689bb621f744f14f0af89437283df795d11efc575af53ee32c29c48031bb364fe613db
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGYr8e2RUHX94R3nwX07QQHO0A:M9iIxuERzA83h09RZxASGOiK+7QV0rK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 090e1af7f6bd99904fc69ea03c4f6c022ed17cb9a068955aa407c727ee21a8c2
MD5 ce173088fe3b48b3a8da7cfb77260403
SHA1 1dbb096cb5c2e8d593d50301890627b2a35c7597
SHA512 84033c5715b4944d6c6fc93037aea010f38c4dcb28ec3df21a897ce6d3dc06e4895133c010e078fafa7baa085d35a54f9486ccbf0468d9886492137a7b6856a6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea
MD5 e07eea85a8893f23fb814cf4b3ed974c
SHA1 8a8125b2890bbddbfc3531d0ee4393dbbf5936fe
SHA512 9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_mw5z4hsk.i15.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mw5z4hsk.i15.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1248-11-0x000002016CF20000-0x000002016CF42000-memory.dmp

Download

memory/1248-55-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/1248-17-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/1248-18-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/1248-14-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/1248-13-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/1248-12-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/4704-56-0x0000000002790000-0x000000000279C000-memory.dmp

Download

memory/4704-54-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/4704-0-0x00007FFEBFE93000-0x00007FFEBFE95000-memory.dmp

Download

memory/4704-2-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

memory/4704-1-0x00000000005A0000-0x00000000005EC000-memory.dmp

Download

memory/4704-380-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads