xworm | hxxps://gofile[.]io/d/2i5Lxt

Analysis

max time kernel
71s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/2i5Lxt

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

45.138.48.39:7000

Attributes

Install_directory
%Userprofile%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000002345c-106.dat	family_xworm
behavioral1/memory/4364-159-0x0000000000730000-0x0000000000762000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	System64 (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	System64 (1).exe

Executes dropped EXE 8 IoCs

pid	Process
4364	System64 (1).exe
2200	System64 (1).exe
3112	System64 (1).exe
4924	System64 (1).exe
4968	System64 (1).exe
824	System64 (1).exe
4200	System64 (1).exe
2504	System64 (1).exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\XClient.exe"	System64 (1).exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 214909.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 964673.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
4868	msedge.exe
4868	msedge.exe
4684	identity_helper.exe
4684	identity_helper.exe
2912	msedge.exe
2912	msedge.exe
4364	System64 (1).exe
4364	System64 (1).exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	System64 (1).exe
Token: SeDebugPrivilege	4364	System64 (1).exe
Token: SeDebugPrivilege	4200	taskmgr.exe
Token: SeSystemProfilePrivilege	4200	taskmgr.exe
Token: SeCreateGlobalPrivilege	4200	taskmgr.exe
Token: 33	4200	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4200	taskmgr.exe
Token: SeDebugPrivilege	2200	System64 (1).exe
Token: SeDebugPrivilege	3112	System64 (1).exe
Token: SeDebugPrivilege	4924	System64 (1).exe
Token: SeDebugPrivilege	4968	System64 (1).exe
Token: SeDebugPrivilege	824	System64 (1).exe
Token: SeDebugPrivilege	4200	System64 (1).exe
Token: SeDebugPrivilege	2504	System64 (1).exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe
4200	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	System64 (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1852	4868	msedge.exe	86
PID 4868 wrote to memory of 1852	4868	msedge.exe	86
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1100	4868	msedge.exe	87
PID 4868 wrote to memory of 1440	4868	msedge.exe	88
PID 4868 wrote to memory of 1440	4868	msedge.exe	88
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89
PID 4868 wrote to memory of 1068	4868	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/2i5Lxt
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffb6cbf46f8,0x7ffb6cbf4708,0x7ffb6cbf4718
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4136
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Users\Admin\Downloads\System64 (1).exe
  "C:\Users\Admin\Downloads\System64 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17208924285925727289,9619069400363784492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb6cbf46f8,0x7ffb6cbf4708,0x7ffb6cbf4718
  2⤵
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System64 (1).exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
174KB

MD5
8f4b19b10ddf43c15608e77cc51fa856

SHA1
31a51811f979f270f3fbc974506e2bb0560c1087

SHA256
3d2000266a9fa7c3567adf69641958d2e38cc5eff421c880ad81be3dba3a7a6d

SHA512
586c7f5ca5be2a7071355c5e8ae39cba47d661b275db4d669981687de8ba1ef4a818f96bdc2491bd8dd7072c937bd3e9b6f773e91f2e7aae4ea29e4a683c6e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
bc6dc15e7d75d82182f2a21330018c0a

SHA1
87a02ba7dd2b1e93d661112ce91cbc4d2714f369

SHA256
a7f0ca75bf24689d8300942f835ba074122b67823db6a22bd7a35fe528ad9b2d

SHA512
9109dfa346a5a1b5a0b23371c21b098e560ffcd6e864ec692c7aa600f8ae5819092de17d54ba52ed43aa8cb9435289a7885d1b5a1d1bf20268a8a08604b3f038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
930B

MD5
6ec748cdeb0dcc9005a2285c1e4cf47c

SHA1
56a942e023290c5b639db6f091fead583228fb03

SHA256
be25132f7e7521c394de59ee540f6bc8e9106c11329bfd131795ea57c342665b

SHA512
7bead2d3917f6b7fa5c0358324aefc9141cbaa595756eabbf91be8641766aaea2f86968be26e81c77fb8e15b3e61e78894dfdbba1e7c2954065e092716d4ed07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1fbea01c6489f4b12f7816da95bc567

SHA1
24cd340b878812413cf1c7c46583ce71986ce514

SHA256
4a57d069056dfd7e441921cda4d80a77e16ce3e26f79388b7f7df4965ade82e3

SHA512
b0c489cb7e72a89f2379f6dffa8e9df91fee9816caebc4677e0c45db207111ffadc62f7d733cc1310940dcebf2e909cc87924b570e6ad1341e8d4b8917eb0647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4faa8c51eb24965317311c6b829a543f

SHA1
259cc5b3d0329ab8be24ffd3c75ff8c2b3a08e78

SHA256
3cc61649c0acbff0432a7b249ac6f92446763f381940b171fd9be73e04f21284

SHA512
c25b576acb929543dfbf2484008ba67f826d06d2a7a1ecab5fdf740417c3226c26f864d752483fcb90c6fc493e103dbbe6535b03fbbfd2e92ab427fe1ce9cc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea6512972a9ab15c11c156e5b8cf89da

SHA1
4482ecd2ff1fc5c4d2af247e63090a22929a969c

SHA256
03de84475e36a53ccc189e34b56f840df124ff654389c7d0b49427788a77017f

SHA512
74e696cedba743d350d1f4fa3e3bffbee77fb7df5b530c06176481733f660aec263d70c0df964584bdb077cc8a67f350882e69b4e48356fc235c8131b24be165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03d9093da77ab9297c1274c3934e2eca

SHA1
e82027da4b3de8b73979db9ed70b84a889a105e5

SHA256
90f714b88aa67cc41feaabd7a7eecebe80b6b1f660b90b5252ba40c3296ec33e

SHA512
3d3c9c5aaf65d5f391e0290ea53d2128552fb1b19a7cf594714e53216fa28723d1d757034f9187b99e57815947e1b7cb309101fa78328e0bb8444fd7ed012cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c309f58afaf77452e998a14dd86bd54e

SHA1
6c7f72c40bbfde5d34262d07b0731d6a80c95e77

SHA256
78f74a3fa6eaeb797fd38ae21ee6d2c72ca596a7b05f8fa57df3169bcc8f479a

SHA512
ac4eddb487669de0c6b2fe97caa69154183a2b30d61184f0709fd8dd69602ad058fd16f5736cee67efaef3b7416d6f23c5146829ee38d77a7bf46fdcddb5bd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
9550b23d9f5339616222525ec82fcd0a

SHA1
2890adee0db77bb493feb3d36223336f98411455

SHA256
5bca29615fe5ec27c97b8439830b04dcd56c43237f8fcc9aa42f233b442fbf7f

SHA512
3a6dc26836fda60ece839d69f3deaa9b6627b85d3dd23baa5882ff444c009c5e2cd5fe6ae48248eb41bef2067c3d6e6fc314df737b1fe760c0d0f252bc6b4cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e000.TMP

Filesize
536B

MD5
fa19cca69aa0d42e47f25369e20fe565

SHA1
92a43b7f4d8bf218b59d18f4de7490e0da0c3252

SHA256
077cba24a65127a64a7c08d47aef4a49a2c74c0a54fc8cc6852a55eaba7c6d70

SHA512
11be7d0f26be5880c9b37a314d7bee185d0144c27e79ec3e72804f5b8b5ecaf3c8beb8efe835c59e2bfb8dda4b2486319ea18680aa5cbd616763713d159bd768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae8c4ee38019a1f6deee8127a8ca8dbb

SHA1
c33630eaa20ea4588f70588c9b537c5f61aa62f3

SHA256
d5d6d89c19c745aeee5661f2909f2cf0c11edeec50a1cba880583561bdea4a8c

SHA512
c20e3cbb649d99eb08590ab597a951a62f7260b4a401f06ce27b3ab137efe7c48dff1c69ed9444c82b4debc31f7cb33c5a10e145a14aee2dea99c1f195f16e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49a7cfcf51a295482c57518a9e66dc85

SHA1
760d642172456a496d4361f33f1b15d281aa0e29

SHA256
f11a623a1e5028844104325b39ff8bb55efd35be6f05b1e4f6ecdaafec6dea1d

SHA512
f6a5a7fbd039235ff64499d694c924cd986852ddc4907197ee010945c7fc65fe7a26098312297d84b7eb28e302929260e9a2716a2806797da4e7cfa28398d1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6b15d1b1206550f89e4b42d4500df4d

SHA1
7d409528e7019d50a5e570ad96fb26cf4b27abab

SHA256
0feac2267ab6f74697da2ae2110bf83894b3fcd313dd760b05e4188a1aa7a190

SHA512
584d2d8c5eddaa3c764f90b440acb27bed48c57acdec99606b223ea6e24b36243be9b9f74838527d93783f970756bf64f98868d182ffbd83279c714a0e836a16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Filesize
780B

MD5
eb36f08309f79fce71247e12b408e935

SHA1
d651305c63a35ce959630eb088079494935b7c71

SHA256
3f508013d9554820f2a17b593c30d5070ce13dc37906fab95d6db684538c3b01

SHA512
7c4307a6f1bff7b380afa3fe8283b73811833e0f5dad5fc40a5d735ae2561935946da0b83fe65c3e1108bc6cfca1c0f1d9a6adcac34aca92eea1c711b861c9ad

Download Submit
memory/4200-185-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-196-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-195-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-194-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-192-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-197-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-193-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-191-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-186-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4200-187-0x000001CD354A0000-0x000001CD354A1000-memory.dmp

Filesize
4KB

Download
memory/4364-159-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download