Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-08-2024 14:09
General
-
Target
launcher.exe
-
Size
126KB
-
MD5
44c6137a640da62e553d4e0c0c92ea85
-
SHA1
cb0039d1f529c70af31fe580680f0529c20c9a9f
-
SHA256
5cd5cb50a9e21ca0a6ed68bb45f7295a97851f8d79108bcfb8311cdc0d420bc8
-
SHA512
adb46b23d889e3b8e5e84567a2bdee447069422743780d8a1f1a788ffe083b2fae143daf9579313280de211189961029313df45baae69d317e4af5722e8327af
-
SSDEEP
3072:EVsADUYOklG1NOuyUGbDf8OIipwYCBxsq9XLsk:Ey4UqlGtyUG3fDIizCBxb9XL
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.0
C2
david-florist.gl.at.ply.gg:34674
Attributes
-
Install_directory
%Public%
-
install_file
USB.exe
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument
Signatures
-
Detect Xworm Payload 2 IoCs
-
Phemedrone
An information and wallet stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dwm" /tr "C:\Users\Public\dwm.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"4⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"5⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"6⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"7⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"8⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"9⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"10⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"11⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"12⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"13⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"14⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"15⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"16⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"17⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"18⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"19⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"20⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3956,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:81⤵
-
C:\Users\Public\dwm.exeC:\Users\Public\dwm.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\dwm.exeC:\Users\Public\dwm.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\dwm.exeC:\Users\Public\dwm.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bb6a89a9355baba2918bb7c32eca1c94
SHA1976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2
SHA256192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b
SHA512efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f
-
Filesize
1KB
MD5d7e08a6cf500fe5ab87b41795962ee19
SHA1dd08782055e3e72f7a8c14ee8a27953825b18c6a
SHA256e74f68eef03565053effbbfb8a786c8858edea751f40cd8c1030ca673f6ba161
SHA512d4d694cde80f00642174c564969c228ae69dd31707b8e9cf52b5564b98b34d1c20857fddfeff66b597bab150be18b8166425f6cc1001c6154ba77611f0bec4d9
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD59405862a3b15dc34824f6a0e5f077f4f
SHA1bbe0000e06be94fa61d6e223fb38b1289908723d
SHA2560a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210
SHA512fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d
-
Filesize
121KB
MD57b6c19c2c8fc4ff9cc5b136f22cf490d
SHA1e557a697a268c54a73aaffd02d25e54c4f601719
SHA256cf6c9880812d48fe7ba3a1d1a1692a881745a7fb8cf6534f94555dd7dd1c3353
SHA512afe23d16011e1eb71ce3be9f8796cf0398cc9e01415c93cd4e8403f1ee84f48e23396ab7709b60d5a9e5b3e5daee9e8f90bae99e6a85ece6475fa8bdd82f953b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
73KB
MD547fb642b2c85bee2624d803bd1109dfe
SHA1452157d77f861436c452ac20a8e48bfb562a7abc
SHA256adf1dfef469dec04d134cee395017041155bde2d7ad89eb0ecd00a0343839268
SHA5129b54b72602b27fb1ce22f3bb62dda748251be60f0ae61a7f35d2a39734dd207f8f638d09bc5fa0ba055110c67e058d39ccf927ed359ea1dae992a8c98efc4cf1
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
152KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
10.8MB