Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 07:09
Errors
Reason
Machine shutdown
General
-
Target
v1.3.3.0.exe
-
Size
127.5MB
-
MD5
41c5b3cfa0a3f5dfddfe5ac7321051de
-
SHA1
39a5ddf6f2ee8d0af3a6098f30110f1120309d9e
-
SHA256
40b828cd407aff07e66bbcf97a9f782d673a2a086494f7b07ae04d9d77c30341
-
SHA512
c130226867922e5ada1f7ac55b3ec3da9c4eefdc8cf70402306c41838772d69fce59ca9bbedad6d7f3de2beeab97276c678df857e68e6c4b46d1695023198357
-
SSDEEP
3145728:8XWxt9yEdZsfJtVzwS92RjOUbK1MXzzJFW4FTPe9eMx/vPv:8XWxt9SfqS9S7KaDzJFxTPUeMx/v
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument
Extracted
Family
xworm
Version
3.0
C2
david-florist.gl.at.ply.gg:34674
Attributes
-
Install_directory
%Public%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Phemedrone
An information and wallet stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 42 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 15 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"4⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"5⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"6⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"7⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"8⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"9⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"10⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"11⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"12⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"13⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"14⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"15⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"16⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"17⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"18⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"19⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"20⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\v1.3.3.0.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"33⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"32⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"31⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"31⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"30⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"30⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"29⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"29⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"28⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"27⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"26⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"25⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\dwm.exe"C:\Users\Admin\AppData\Local\Temp\dwm.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\dwm.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dwm" /tr "C:\Users\Public\dwm.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 03⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\dwm.exeC:\Users\Public\dwm.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\dwm.exeC:\Users\Public\dwm.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38b8855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d7e08a6cf500fe5ab87b41795962ee19
SHA1dd08782055e3e72f7a8c14ee8a27953825b18c6a
SHA256e74f68eef03565053effbbfb8a786c8858edea751f40cd8c1030ca673f6ba161
SHA512d4d694cde80f00642174c564969c228ae69dd31707b8e9cf52b5564b98b34d1c20857fddfeff66b597bab150be18b8166425f6cc1001c6154ba77611f0bec4d9
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
1KB
MD5bb6a89a9355baba2918bb7c32eca1c94
SHA1976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2
SHA256192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b
SHA512efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f
-
Filesize
944B
MD53cba3d45991c5d202e37b0009f367c63
SHA12399c3781e8a2d724190f8add8f6052b381366a0
SHA2563f60736edc36717c21b3b40ab6577dd76cc5efda424cbb65621e6dd24d65e739
SHA5123c1760319b069dc46ccd92eb661cad59e8d60a057a09c2fe2040ab685bd48536575be616737bb0e18c5a746b644de6a9514438424e695be89d78d60573ab2cd0
-
Filesize
944B
MD5ef647504cf229a16d02de14a16241b90
SHA181480caca469857eb93c75d494828b81e124fda0
SHA25647002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710
SHA512a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1
-
Filesize
121KB
MD57b6c19c2c8fc4ff9cc5b136f22cf490d
SHA1e557a697a268c54a73aaffd02d25e54c4f601719
SHA256cf6c9880812d48fe7ba3a1d1a1692a881745a7fb8cf6534f94555dd7dd1c3353
SHA512afe23d16011e1eb71ce3be9f8796cf0398cc9e01415c93cd4e8403f1ee84f48e23396ab7709b60d5a9e5b3e5daee9e8f90bae99e6a85ece6475fa8bdd82f953b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
73KB
MD547fb642b2c85bee2624d803bd1109dfe
SHA1452157d77f861436c452ac20a8e48bfb562a7abc
SHA256adf1dfef469dec04d134cee395017041155bde2d7ad89eb0ecd00a0343839268
SHA5129b54b72602b27fb1ce22f3bb62dda748251be60f0ae61a7f35d2a39734dd207f8f638d09bc5fa0ba055110c67e058d39ccf927ed359ea1dae992a8c98efc4cf1
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
144KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
10.8MB