Overview

overview

10

Static

static

3

launcher.exe

windows10-2004-x64

Analysis

  • max time kernel
    108s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-08-2024 17:56

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    launcher.exe

  • Size

    126KB

  • MD5

    fea0755616dfcc13768284ecff25787c

  • SHA1

    acbcf648ec2c6888c6045d6b1f724008e0cdce9f

  • SHA256

    90253f78c82a5bac0d4e13efa4b90e179ff6eeaf7e72ca6f5094af50d6c9baea

  • SHA512

    57d2f5f51891c31a35f74ccf635ea5ba54fa99cfc3142ba3feee46a70a6bfadf1b49879094360fa3d0e98245d4aabb845bcfec6986c628a7dc2dca8a536308a2

  • SSDEEP

    3072:NecOklG1NOuyUGbDf8OIipwYCBxsD9iLs7:kGlGtyUG3fDIizCBxo9iL

Score
10/10
phemedronexwormcredential_accessexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Extracted

Family

xworm

Version

3.0

C2

david-florist.gl.at.ply.gg:34674

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 38 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dwm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:860
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dwm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\dwm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3472
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dwm" /tr "C:\Users\Public\dwm.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4884
      • C:\Windows\SYSTEM32\shutdown.exe
        shutdown.exe /f /s /t 0
        3⤵
          PID:4832
      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:640
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Users\Admin\AppData\Local\Temp\dwm.exe
          "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4856
        • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
          "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4928
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Users\Admin\AppData\Local\Temp\dwm.exe
            "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3364
          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2028
          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4268
            • C:\Users\Admin\AppData\Local\Temp\dwm.exe
              "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4368
            • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
              "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4360
            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
              5⤵
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4788
              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2972
              • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3560
              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                6⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4812
                • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                  "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4232
                • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4668
                • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                  7⤵
                  • Checks computer location settings
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:800
                  • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                    "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:860
                  • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1756
                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                    8⤵
                    • Checks computer location settings
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3968
                    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4532
                    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3188
                    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                      9⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4568
                      • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                        "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:640
                      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1868
                      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                        10⤵
                        • Checks computer location settings
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2592
                        • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                          "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4620
                        • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                          "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3572
                        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                          11⤵
                          • Checks computer location settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3732
                          • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                            "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                            12⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4628
                          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                            12⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:332
                          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                            12⤵
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4200
                            • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                              "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3148
                            • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                              "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4504
                            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                              13⤵
                              • Checks computer location settings
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4836
                              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                14⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2972
                              • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                14⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:408
                              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                14⤵
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4272
                                • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                  "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:676
                                • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3236
                                • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                  15⤵
                                  • Checks computer location settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:796
                                  • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                    "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3780
                                  • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1936
                                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                    16⤵
                                    • Checks computer location settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4620
                                    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4968
                                    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1860
                                    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                      17⤵
                                      • Checks computer location settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2024
                                      • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                        "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:540
                                      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4928
                                      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                        18⤵
                                        • Checks computer location settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4772
                                        • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                          "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4092
                                        • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1344
                                        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                          19⤵
                                          • Checks computer location settings
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1128
                                          • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                            "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4272
                                          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4980
                                          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                            20⤵
                                            • Checks computer location settings
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3780
                                            • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                              "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3580
                                            • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3008
                                            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                              21⤵
                                              • Checks computer location settings
                                              PID:2484
                                              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                PID:728
                                              • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4864
                                              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                22⤵
                                                • Checks computer location settings
                                                PID:4620
                                                • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  PID:1500
                                                • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4344
                                                • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  PID:3236
                                                  • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    PID:792
                                                  • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2296
                                                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    PID:4772
                                                    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      PID:4404
                                                    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4572
                                                    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:4568
                                                      • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        PID:540
                                                      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4624
                                                      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:4620
                                                        • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          PID:4088
                                                        • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4540
                                                        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          PID:1316
                                                          • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            PID:2352
                                                          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2244
                                                          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            PID:3980
                                                            • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              PID:3372
                                                            • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4212
                                                            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:2316
                                                              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                PID:3384
                                                              • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                PID:3352
                                                              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                PID:2788
                                                                • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  PID:5004
                                                                • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  PID:540
                                                                • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  PID:3192
                                                                  • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    PID:3296
                                                                  • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    PID:4768
                                                                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    PID:3976
                                                                    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      PID:4568
                                                                    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                      33⤵
                                                                        PID:3124
                                                                      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                        33⤵
                                                                        • Checks computer location settings
                                                                        PID:4916
                                                                        • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                          34⤵
                                                                            PID:4812
                                                                          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                            34⤵
                                                                              PID:1040
                                                                            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                              34⤵
                                                                              • Checks computer location settings
                                                                              PID:2296
                                                                              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                                35⤵
                                                                                  PID:4232
                                                                                • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                                  35⤵
                                                                                    PID:2304
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                                    35⤵
                                                                                    • Checks computer location settings
                                                                                    PID:4620
                                                                                    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                                      36⤵
                                                                                        PID:4796
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                                        36⤵
                                                                                          PID:2216
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                                          36⤵
                                                                                          • Checks computer location settings
                                                                                          PID:4080
                                                                                          • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                                            37⤵
                                                                                              PID:1172
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                                              37⤵
                                                                                                PID:5052
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                                                37⤵
                                                                                                • Checks computer location settings
                                                                                                PID:2308
                                                                                                • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
                                                                                                  38⤵
                                                                                                    PID:852
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
                                                                                                    38⤵
                                                                                                      PID:3636
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                                                                                                      38⤵
                                                                                                        PID:3344
                            • C:\Users\Public\dwm.exe
                              C:\Users\Public\dwm.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3920
                            • C:\Users\Public\dwm.exe
                              C:\Users\Public\dwm.exe
                              1⤵
                                PID:3088
                              • C:\Windows\system32\LogonUI.exe
                                "LogonUI.exe" /flags:0x4 /state0:0xa38cf855 /state1:0x41c64e6d
                                1⤵
                                • Modifies data under HKEY_USERS
                                • Suspicious use of SetWindowsHookEx
                                PID:2376

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Modify Registry

                              1
                              T1112

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              3
                              T1552

                              Credentials In Files

                              3
                              T1552.001

                              Discovery

                              Query Registry

                              2
                              T1012

                              System Information Discovery

                              2
                              T1082

                              Lateral Movement

                              Collection

                              Data from Local System

                              2
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Launcher.exe.log
                                Filesize

                                1KB

                                MD5

                                bb6a89a9355baba2918bb7c32eca1c94

                                SHA1

                                976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2

                                SHA256

                                192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b

                                SHA512

                                efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Sync Center.exe.log
                                Filesize

                                1KB

                                MD5

                                d7e08a6cf500fe5ab87b41795962ee19

                                SHA1

                                dd08782055e3e72f7a8c14ee8a27953825b18c6a

                                SHA256

                                e74f68eef03565053effbbfb8a786c8858edea751f40cd8c1030ca673f6ba161

                                SHA512

                                d4d694cde80f00642174c564969c228ae69dd31707b8e9cf52b5564b98b34d1c20857fddfeff66b597bab150be18b8166425f6cc1001c6154ba77611f0bec4d9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log
                                Filesize

                                654B

                                MD5

                                2ff39f6c7249774be85fd60a8f9a245e

                                SHA1

                                684ff36b31aedc1e587c8496c02722c6698c1c4e

                                SHA256

                                e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                SHA512

                                1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                d85ba6ff808d9e5444a4b369f5bc2730

                                SHA1

                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                SHA256

                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                SHA512

                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                944B

                                MD5

                                d28a889fd956d5cb3accfbaf1143eb6f

                                SHA1

                                157ba54b365341f8ff06707d996b3635da8446f7

                                SHA256

                                21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                SHA512

                                0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                944B

                                MD5

                                ba169f4dcbbf147fe78ef0061a95e83b

                                SHA1

                                92a571a6eef49fff666e0f62a3545bcd1cdcda67

                                SHA256

                                5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                                SHA512

                                8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
                                Filesize

                                121KB

                                MD5

                                7b6c19c2c8fc4ff9cc5b136f22cf490d

                                SHA1

                                e557a697a268c54a73aaffd02d25e54c4f601719

                                SHA256

                                cf6c9880812d48fe7ba3a1d1a1692a881745a7fb8cf6534f94555dd7dd1c3353

                                SHA512

                                afe23d16011e1eb71ce3be9f8796cf0398cc9e01415c93cd4e8403f1ee84f48e23396ab7709b60d5a9e5b3e5daee9e8f90bae99e6a85ece6475fa8bdd82f953b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_afbs5bmz.0mq.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\dwm.exe
                                Filesize

                                73KB

                                MD5

                                47fb642b2c85bee2624d803bd1109dfe

                                SHA1

                                452157d77f861436c452ac20a8e48bfb562a7abc

                                SHA256

                                adf1dfef469dec04d134cee395017041155bde2d7ad89eb0ecd00a0343839268

                                SHA512

                                9b54b72602b27fb1ce22f3bb62dda748251be60f0ae61a7f35d2a39734dd207f8f638d09bc5fa0ba055110c67e058d39ccf927ed359ea1dae992a8c98efc4cf1

                                Download Submit

                              • memory/640-29-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/640-25-0x0000000000970000-0x0000000000994000-memory.dmp

                                Filesize

                                144KB

                                Download

                              • memory/640-79-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/640-88-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/860-41-0x000001D87F140000-0x000001D87F162000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/952-31-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/952-0-0x00007FF960203000-0x00007FF960205000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/952-2-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/952-1-0x0000000000920000-0x0000000000946000-memory.dmp

                                Filesize

                                152KB

                                Download

                              • memory/5024-27-0x0000000000350000-0x0000000000368000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/5024-28-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/5024-80-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/5024-202-0x0000000002500000-0x000000000250A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/5024-282-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download