xworm | 6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df

Analysis

max time kernel
251s
max time network
256s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

XClient.exe
Size

283KB
MD5

94d7570a4d6becf9ccccac918fc7a525
SHA1

8e9fa909a7f38b1f4481ee880340c96aa03a9a84
SHA256

6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df
SHA512

d97b0b2c758e3288ffbacf1111b621f0530ad152830b17795a8734e4d30cd85c5578d94983f6668222028e45095582a05a41033df0bf1061fb18124fe7fa8e7f
SSDEEP

3072:c43Cklb4wOyopUd87kREhYyZxbHrR6Y7zjokEtNaaayMakxiJ+UZeQnjm9sjSwkm:bpbVoA8oKhsrx8iJZeQiWsVCA2aAN0F

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

hard-tyler.gl.at.ply.gg:27490

Attributes

Install_directory
%Temp%
install_file
systemprocess.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral5/memory/4704-1-0x00000000005A0000-0x00000000005EC000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1248	powershell.exe
3824	powershell.exe
3520	powershell.exe
3540	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\systemprocess = "C:\\Users\\Admin\\AppData\\Local\\Temp\\systemprocess.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1248	powershell.exe
1248	powershell.exe
3824	powershell.exe
3824	powershell.exe
3520	powershell.exe
3520	powershell.exe
3540	powershell.exe
3540	powershell.exe
4704	XClient.exe
940	msedge.exe
940	msedge.exe
1216	msedge.exe
1216	msedge.exe
1036	msedge.exe
1036	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	XClient.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	4704	XClient.exe
Token: 33	1452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1452	AUDIODG.EXE
Token: SeShutdownPrivilege	1572	shutdown.exe
Token: SeRemoteShutdownPrivilege	1572	shutdown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1248	4704	XClient.exe	78
PID 4704 wrote to memory of 1248	4704	XClient.exe	78
PID 4704 wrote to memory of 3824	4704	XClient.exe	80
PID 4704 wrote to memory of 3824	4704	XClient.exe	80
PID 4704 wrote to memory of 3520	4704	XClient.exe	82
PID 4704 wrote to memory of 3520	4704	XClient.exe	82
PID 4704 wrote to memory of 3540	4704	XClient.exe	84
PID 4704 wrote to memory of 3540	4704	XClient.exe	84
PID 4704 wrote to memory of 1216	4704	XClient.exe	86
PID 4704 wrote to memory of 1216	4704	XClient.exe	86
PID 1216 wrote to memory of 3192	1216	msedge.exe	87
PID 1216 wrote to memory of 3192	1216	msedge.exe	87
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 4544	1216	msedge.exe	88
PID 1216 wrote to memory of 940	1216	msedge.exe	89
PID 1216 wrote to memory of 940	1216	msedge.exe	89
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90
PID 1216 wrote to memory of 3468	1216	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/serc
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed1a03cb8,0x7ffed1a03cc8,0x7ffed1a03cd8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4788 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14205238180868288519,5491215897879221871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:3560
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e855 /state1:0x41c64e6d
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1024KB

MD5
428ff1ac3ce2c4453eda8d22c4260b27

SHA1
7ac34f3fa075459aae5f00579adb0f8af66bcfda

SHA256
5e21b684d1423fd501eccabed11d155887cd6a8a485161127cf2fa2d55406ba1

SHA512
134d37f4509fa565d1d27fdfa3d2d1e86df5484aaffb2380df9453cf39807ef94a92f41d1bd6d50a63a3ea872b1d21dfc65cd088cbcb4416afcbfa1ab7eff77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
1024KB

MD5
19756d5e06ee30af80bf8470522adc98

SHA1
45801241647406251978f133990b0e553fa2b26d

SHA256
e61bf27dc4f42d5e7183def20da8ec1cf29e7900a6c6b0ba42d12094b717e5f0

SHA512
5860d6417cf2b2d8ec726a1c71662d3ce578cdc5f45ea4e9fe3640c9c6b91c2f80bf7f2df69dc992491425925103dc4d7cea60448aadb4fbe7df4b20ba8e2043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
64KB

MD5
5e48476ce79470b7c30fbfaeee85732f

SHA1
936735216ce36c698cf8753ac5a01de3b918e1e2

SHA256
3fcdf72605db2a0d4dac079c7cfee8718a5b9ddc6d6cbd035c40334edba81d9e

SHA512
d73fcdf2551f3b706807ebfcb98e38671f2953f9df7778407732c616a9a6beb4dad403fc5fba5ee8e00d3c19d9f9396d6c9295ef5122f6a6cb2902968425a5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
18d46003afae10c03c96fb3e5b5fb072

SHA1
12af29e19b8edf1ac7882a19cdf5d0815dc9a592

SHA256
df597c36a15ff519aaddbe569a069403a8878422b9a1dd56734ad066daf3c302

SHA512
42dbd2a5353dce555bd496ce087342b54002d0d805328e8ac3192cfde5e6d7057af15f742671c8bea11e638d95001895301fdb84755a460b08a5b6c6198c043e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0421b2f4b70f9a7f29260e00ecfee4c9

SHA1
2ef7ccd7e8a17f42efa6496552b494e6a9e1201e

SHA256
1a606729508baf39653a269bd1b5a287ed6d1c3223ff403981bbfe93402f98c6

SHA512
3413ad00b81444e1b06da69d157b19e9007ef60a1d5866d464fcd75178d03bac57a240f628fbf518f7a6a35e3a484eb6b769e7b6ea0486da27628f438a3db9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
818b473c12505afd7fd2e332c7d6b9f1

SHA1
13438d1acf5c792abecba188a14acdc1975e3bea

SHA256
5f65131339e48ef8c0d87e2802205c6ce98bcd866997194aff4fb6fa06247d82

SHA512
aa597fbf1ef1b9a56dd0205a8c75781c55aefefa7400cdacee67652a09ba595d9fc08fe282131752f781be95739211b2141bcce5abf11d03c017e11c328dc422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
618c28a07e13240a9cbed08b723964b4

SHA1
5c2c59a86b3ba01bbb6b7e68e308e44f4ceadce3

SHA256
6c3bdf5196f80771f86f60d34c705a2fc3fdcb9022b6f77efd8788b0614214e5

SHA512
671b9e91c98e330ed613f19a03228db3af68925d9d0f6f8f37f3002c87e0179588fbb952bee7bce28bd42601bf5185fb8f2970d7532d6836db06cf06540f156a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8be8635a816e2ff8d21933cfbe2b5b5

SHA1
78f64752ebb8f15d44f9b40846f94ac697f6765e

SHA256
b9690c27a1b89dfc307548f43ddf1af7765cd076bd3f8cd32a12288d8a993528

SHA512
1a1a30e4b5f0f690dd50daf362906b98f4301446f4c848cacca0dbdb89c8549e98795eb3b927af97b74405c50294530c081f2e5a4d25f6570bc91836e91b49ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ea068351054f39fea17e17090997215

SHA1
4285c15a3f65dd9a849eca31d12a3267717e1609

SHA256
f36bf10fb92c8aaa7a76ffd32a0b2225237b8596549a06fef02f45068b9f8cf8

SHA512
d15de37e2e32e91d631b3292e8db218952c0bcff8c1920608603143baf0ef14b9f9b06ef3e0c9007f0dc8f1ddaf2fe2ba3faa298942fe407a82be22f0009de0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
384049da4fb2f108b093c578c25e4863

SHA1
d1aa2a51862432ff5ecec46de973714c37aac235

SHA256
bbd12abcc5805c586c00353728d217c57344a36aa1d4b058bf737a77b6639bfa

SHA512
3f549cc8a298e6be83fade3a03062b8adaec84a32c4ff95cdc70f41129bc1bd53956c64e32726278ac3568ce3e22f8b4d35ce454a1fd4418dc76f3f8ab2fafe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c75d.TMP

Filesize
204B

MD5
3fd68ada01dd262c28a36e207a6a3e15

SHA1
b18f2ab721a850ced03c0785f623c90ef952d751

SHA256
a61835febd533978980e397828fc1593d5d8c3f38c0034a3e108e9909d4b9deb

SHA512
8b71e51120f0eb600625fec462c9bfc24651a5b091959dae5b385537c6165d6a5016f5d21f8b08826eaa05385a8bf82214201b235d5dd701ff7eac90e83ebbce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90847be568eb8ea635212a62bff76ddf

SHA1
bf5ef292b818b49442c0581bdad114b7aa1dd389

SHA256
08b036938b344d7dd42e4ab911320049931871e45b66e332f863df301911533c

SHA512
b284ad05d2416e86d4826233adb538fee707fa1dd22afd1ac3b71e5c7d7b52610b10df78d1376c6779f57e7178c4188e71fe21149f092072ca9d19a41c4eeea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ce5bb374bbea4b5f24f16f5029839f7

SHA1
dcf2c83c6ffeb92fa4d328445192e13f987d346b

SHA256
1874d91173d8d07fefa7c8be3ace0a5bc1c683e425acc1c07b5da24b708c8c9c

SHA512
5158901f87570a43c6b3a93cf9b3954318d0d0b7577e8d2855fce23da5689bb621f744f14f0af89437283df795d11efc575af53ee32c29c48031bb364fe613db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce173088fe3b48b3a8da7cfb77260403

SHA1
1dbb096cb5c2e8d593d50301890627b2a35c7597

SHA256
090e1af7f6bd99904fc69ea03c4f6c022ed17cb9a068955aa407c727ee21a8c2

SHA512
84033c5715b4944d6c6fc93037aea010f38c4dcb28ec3df21a897ce6d3dc06e4895133c010e078fafa7baa085d35a54f9486ccbf0468d9886492137a7b6856a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e07eea85a8893f23fb814cf4b3ed974c

SHA1
8a8125b2890bbddbfc3531d0ee4393dbbf5936fe

SHA256
83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea

SHA512
9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mw5z4hsk.i15.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1248-11-0x000002016CF20000-0x000002016CF42000-memory.dmp

Filesize
136KB

Download
memory/1248-55-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/1248-17-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/1248-18-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/1248-14-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/1248-13-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/1248-12-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/4704-56-0x0000000002790000-0x000000000279C000-memory.dmp

Filesize
48KB

Download
memory/4704-54-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/4704-0-0x00007FFEBFE93000-0x00007FFEBFE95000-memory.dmp

Filesize
8KB

Download
memory/4704-2-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download
memory/4704-1-0x00000000005A0000-0x00000000005EC000-memory.dmp

Filesize
304KB

Download
memory/4704-380-0x00007FFEBFE90000-0x00007FFEC0952000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads