xworm | abf05fddbb728e0cf67da50245a63c28b383c3d50573b3c96cd15032d0af38f5

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WebhookSpammerV1.exe
Size

206KB
MD5

c669b7aac0c6d6e5a2b09fa060835720
SHA1

cff60e01094fa203715b76820c1b37a680381108
SHA256

abf05fddbb728e0cf67da50245a63c28b383c3d50573b3c96cd15032d0af38f5
SHA512

d4ecafc845ed6430bb802c18811dd79227e568e9feef12dbba73ee983b98b1c87002c3e62ab5c39278dedf4da23ce16ba007dd970a564a6d87acaf1e692f803a
SSDEEP

6144:gm8K32BN6NqV27EG8oMa0UpLaAFMJU5Ma3qjFRlqXwmXRen:g82indvsa3qjFRlqXwmB

Score

10^/10

xworm defense_evasion discovery evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

since-searching.gl.at.ply.gg:64197

Attributes

Install_directory
%ProgramData%
install_file
Helper.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2916-183-0x000000001D010000-0x000000001D02E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4360	powershell.exe
380	powershell.exe
2012	powershell.exe
4628	powershell.exe
3460	powershell.exe
1836	powershell.exe
2312	powershell.exe
1812	powershell.exe
3032	powershell.exe
2004	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Latite_Client_betterV1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Latite Client_BetterV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WebhookSpammerV1.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	Latite Client_BetterV3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	Latite Client_BetterV3.exe

Executes dropped EXE 8 IoCs

pid	Process
4132	Latite_Client_betterV1.exe
2916	Latite Client_BetterV3.exe
3996	WindowsDefender
2948	Latite Client_BetterV3.exe
5100	Latite_Client_betterV1.exe
3944	WindowsDefender
856	Latite Client_BetterV3.exe
4356	Latite_Client_betterV1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\ProgramData\\WindowsDefender"	Latite Client_BetterV3.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Latite_Client_betterV1.exe	WebhookSpammerV1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebhookSpammerV1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1668	schtasks.exe
1096	schtasks.exe
1948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1540	powershell.exe
4380	powershell.exe
1540	powershell.exe
4380	powershell.exe
2004	powershell.exe
2004	powershell.exe
3460	powershell.exe
3460	powershell.exe
1836	powershell.exe
1836	powershell.exe
4336	powershell.exe
2376	powershell.exe
2376	powershell.exe
4336	powershell.exe
4336	powershell.exe
2376	powershell.exe
2312	powershell.exe
2312	powershell.exe
1812	powershell.exe
1812	powershell.exe
4360	powershell.exe
4360	powershell.exe
380	powershell.exe
380	powershell.exe
2012	powershell.exe
2012	powershell.exe
4628	powershell.exe
4628	powershell.exe
3032	powershell.exe
3032	powershell.exe
2916	Latite Client_BetterV3.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	Latite_Client_betterV1.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	2916	Latite Client_BetterV3.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2916	Latite Client_BetterV3.exe
Token: SeDebugPrivilege	3996	WindowsDefender
Token: SeDebugPrivilege	2948	Latite Client_BetterV3.exe
Token: SeDebugPrivilege	5100	Latite_Client_betterV1.exe
Token: SeDebugPrivilege	3944	WindowsDefender
Token: SeDebugPrivilege	856	Latite Client_BetterV3.exe
Token: SeDebugPrivilege	4356	Latite_Client_betterV1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	Latite Client_BetterV3.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1540	3764	WebhookSpammerV1.exe	84
PID 3764 wrote to memory of 1540	3764	WebhookSpammerV1.exe	84
PID 3764 wrote to memory of 1540	3764	WebhookSpammerV1.exe	84
PID 3764 wrote to memory of 4380	3764	WebhookSpammerV1.exe	86
PID 3764 wrote to memory of 4380	3764	WebhookSpammerV1.exe	86
PID 3764 wrote to memory of 4380	3764	WebhookSpammerV1.exe	86
PID 3764 wrote to memory of 4132	3764	WebhookSpammerV1.exe	88
PID 3764 wrote to memory of 4132	3764	WebhookSpammerV1.exe	88
PID 4132 wrote to memory of 2004	4132	Latite_Client_betterV1.exe	94
PID 4132 wrote to memory of 2004	4132	Latite_Client_betterV1.exe	94
PID 4132 wrote to memory of 3460	4132	Latite_Client_betterV1.exe	96
PID 4132 wrote to memory of 3460	4132	Latite_Client_betterV1.exe	96
PID 4132 wrote to memory of 1836	4132	Latite_Client_betterV1.exe	98
PID 4132 wrote to memory of 1836	4132	Latite_Client_betterV1.exe	98
PID 4132 wrote to memory of 1668	4132	Latite_Client_betterV1.exe	101
PID 4132 wrote to memory of 1668	4132	Latite_Client_betterV1.exe	101
PID 4132 wrote to memory of 4336	4132	Latite_Client_betterV1.exe	103
PID 4132 wrote to memory of 4336	4132	Latite_Client_betterV1.exe	103
PID 4132 wrote to memory of 2376	4132	Latite_Client_betterV1.exe	105
PID 4132 wrote to memory of 2376	4132	Latite_Client_betterV1.exe	105
PID 4132 wrote to memory of 2916	4132	Latite_Client_betterV1.exe	107
PID 4132 wrote to memory of 2916	4132	Latite_Client_betterV1.exe	107
PID 2916 wrote to memory of 2312	2916	Latite Client_BetterV3.exe	109
PID 2916 wrote to memory of 2312	2916	Latite Client_BetterV3.exe	109
PID 2916 wrote to memory of 1812	2916	Latite Client_BetterV3.exe	111
PID 2916 wrote to memory of 1812	2916	Latite Client_BetterV3.exe	111
PID 2916 wrote to memory of 4360	2916	Latite Client_BetterV3.exe	113
PID 2916 wrote to memory of 4360	2916	Latite Client_BetterV3.exe	113
PID 2916 wrote to memory of 1096	2916	Latite Client_BetterV3.exe	115
PID 2916 wrote to memory of 1096	2916	Latite Client_BetterV3.exe	115
PID 2916 wrote to memory of 380	2916	Latite Client_BetterV3.exe	119
PID 2916 wrote to memory of 380	2916	Latite Client_BetterV3.exe	119
PID 2916 wrote to memory of 2012	2916	Latite Client_BetterV3.exe	121
PID 2916 wrote to memory of 2012	2916	Latite Client_BetterV3.exe	121
PID 2916 wrote to memory of 4628	2916	Latite Client_BetterV3.exe	123
PID 2916 wrote to memory of 4628	2916	Latite Client_BetterV3.exe	123
PID 2916 wrote to memory of 3032	2916	Latite Client_BetterV3.exe	125
PID 2916 wrote to memory of 3032	2916	Latite Client_BetterV3.exe	125
PID 2916 wrote to memory of 1948	2916	Latite Client_BetterV3.exe	127
PID 2916 wrote to memory of 1948	2916	Latite Client_BetterV3.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WebhookSpammerV1.exe
"C:\Users\Admin\AppData\Local\Temp\WebhookSpammerV1.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAbgB6ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHEAeAB0ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAcwBvAHIAcgB5ACAAZABvAHcAbgAgAGYAbwByACAAbgBvAHcAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGQAaQBlACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAagBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAcQBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAbgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHcAawB6ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\Latite_Client_betterV1.exe
  "C:\Windows\Latite_Client_betterV1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Latite_Client_betterV1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Latite_Client_betterV1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Latite_Client_betterV1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "Latite_Client_betterV1" /tr "C:\ProgramData\Latite_Client_betterV1.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAdABzACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHQAbQBmACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZQByAHIAbwByACAAbgBvAHQAIAB3AG8AcgBrAGkAbgBnACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB6AHkAdAAjAD4A"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAeQBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcwBmACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Latite Client_BetterV3.exe
    "C:\Users\Admin\AppData\Local\Temp\Latite Client_BetterV3.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Latite Client_BetterV3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Latite Client_BetterV3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Latite Client_BetterV3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4360
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "Latite Client_BetterV3" /tr "C:\ProgramData\Latite Client_BetterV3.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Latite Client_BetterV3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Latite Client_BetterV3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsDefender'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsDefender" /tr "C:\ProgramData\WindowsDefender"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1948

C:\ProgramData\WindowsDefender
C:\ProgramData\WindowsDefender
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\ProgramData\Latite Client_BetterV3.exe
"C:\ProgramData\Latite Client_BetterV3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\ProgramData\Latite_Client_betterV1.exe
C:\ProgramData\Latite_Client_betterV1.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\ProgramData\WindowsDefender
C:\ProgramData\WindowsDefender
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\ProgramData\Latite Client_BetterV3.exe
"C:\ProgramData\Latite Client_BetterV3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\ProgramData\Latite_Client_betterV1.exe
C:\ProgramData\Latite_Client_betterV1.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsDefender.log

Filesize
1KB

MD5
3982d6d16fd43ae609fd495bb33433a2

SHA1
6c33cd681fdfd9a844a3128602455a768e348765

SHA256
9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

SHA512
4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6b1c5ea2c5137edbb0c2ddff28a26aa9

SHA1
85077c82c804eda55de290cb6c3475298c8ee10a

SHA256
114bf082e3af8ee1ab17642fa74e6555fa0316174b6145082c74f37b676294ea

SHA512
cf378748d8b4065881ad2355c4d42394d423cd3cf2378b8543c6caa8137c9e30c64462aa33b6637de70a0920eb7a758297c50b7b7657e43a94cf68ab6d70745e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3e12815558de28b7f32b1e567cc85991

SHA1
8b6d6130cc12e45adedb57e54cd2a8f19e906759

SHA256
7aba7349ceb9f11e1a3e5167cc2f551f59e078ed2ca6d9a07d08482fab779268

SHA512
4dfbc98cbcdb27b72edf10fadb8ddf33185c25c6b77a9d293760c427a84ae3a851598da804a7f5b11bfe369b088df91d3ee0e2e3d8d91f77dd7e5779636cf993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
edc698bbe4fd5ede6fcb891538fe67f9

SHA1
2e3b1baeeacf187587eb636b6e4b14f6c3bf5714

SHA256
1a5aecb237083b62b36e11935947022b821bfc319e276cfbba90c0a0a04cefd9

SHA512
e0c38576e752a4d77bc3b6f3f6f52506f2f929d6f48318ae691eaad628e373f76b566cad5d85548b6ac316be681b570dc7f1b4c7002128c139cb55065d1d19a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
bbd656255a15213d2040a42492d90235

SHA1
67cd5a78a79287a49db6cf271d4a7e750dd8205d

SHA256
fbe36c0ffd4c3d4bcd13b24e7f245bc6f1f033f9f3b3d6bbefb6e166129f4671

SHA512
577ad0febee0e438e4d3e723098760e4752afa9407178f504c8975b1c0f988bd091d2680ba2ef9d3d4ebf01b5fdf6e3bf2c564709026ff5cc1671577a76aa4a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd1d0b083fedf44b482a028fb70b96e8

SHA1
dc9c027937c9f6d52268a1504cbae42a39c8d36a

SHA256
cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

SHA512
96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8ab6456a8ec71255cb9ead0bb5d27767

SHA1
bc9ff860086488478e7716f7ac4421e8f69795fb

SHA256
bcb14f15fbe23bf51a657c69b24f09cd51e33a2530f89ad17c44f660769611e2

SHA512
87c5368dbd7c85f341edf8992d8b1c87984f9a3549a4802c6054da4e12a8674f10f56d03afc1a72b2cfc40895150d3b0f4d9d4c355c79cdf364ace35eb8ebf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9a49fe49139e841271156738b138800c

SHA1
092c8521734d48706f8c284b5055e61f4cf4d1f6

SHA256
64966e4d9b872f850855917869c8f4ae98c153e8838363d69120b64dd1d4f1b2

SHA512
41e7afa61d57c77e3fceddd097bd8dd0ae019ceddb75687eee7ae4fab708e78be2c62ef03e8e674a0d125f571d0c83c87d9c28c5895b9d86c5d0e83064430eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Latite Client_BetterV3.exe

Filesize
143KB

MD5
a677d044cc4d2fe27653f8f285996134

SHA1
30c586c84ee5b9299450b5871ec7186dee562777

SHA256
960d607391f69a4213108dfd0beb8acd0278e6dbefd74dbcb70cac38fc1bde58

SHA512
ec75aa4f63a6989493641bf3aef6869856896e9accd7508a0eb155f8b8e7d790c5b3a444f99214f4044fa7a2c5334515142fe06818abe8712faa49308fb66a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23s0u4gn.5zt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Latite_Client_betterV1.exe

Filesize
196KB

MD5
ce0b8f899eaf246c39df74a3d6469c15

SHA1
5806a235161b97ff98b8d3788583700480b763be

SHA256
91fae5a53a72146265efb73813d170e6c261f3154e4b1d97e969169ea8b55669

SHA512
a652172836902b8b025bfd836787706d0ea8e6bb3f2385b54687e2ada84c9ed13f7c7ef9afa784c3c4d9a91ad2330be03cbaccabf20c8fb481a36758420740d4

Download Submit
memory/1540-45-0x0000000006090000-0x00000000060DC000-memory.dmp

Filesize
304KB

Download
memory/1540-187-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/1540-13-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Filesize
4KB

Download
memory/1540-22-0x0000000004A20000-0x0000000004A42000-memory.dmp

Filesize
136KB

Download
memory/1540-48-0x0000000007120000-0x000000000779A000-memory.dmp

Filesize
6.5MB

Download
memory/1540-59-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

Filesize
104KB

Download
memory/1540-44-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

Filesize
120KB

Download
memory/1540-19-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/1540-147-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/1540-61-0x0000000007D50000-0x00000000082F4000-memory.dmp

Filesize
5.6MB

Download
memory/1540-62-0x0000000006EC0000-0x0000000006F52000-memory.dmp

Filesize
584KB

Download
memory/1540-146-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Filesize
4KB

Download
memory/1540-18-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2004-73-0x000001FC61050000-0x000001FC61072000-memory.dmp

Filesize
136KB

Download
memory/2916-122-0x0000000000C20000-0x0000000000C48000-memory.dmp

Filesize
160KB

Download
memory/2916-183-0x000000001D010000-0x000000001D02E000-memory.dmp

Filesize
120KB

Download
memory/4132-20-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

Filesize
64KB

Download
memory/4132-145-0x00007FFEFDA23000-0x00007FFEFDA25000-memory.dmp

Filesize
8KB

Download
memory/4132-169-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

Filesize
64KB

Download
memory/4132-110-0x000000001C860000-0x000000001C890000-memory.dmp

Filesize
192KB

Download
memory/4132-12-0x0000000000420000-0x0000000000458000-memory.dmp

Filesize
224KB

Download
memory/4132-11-0x00007FFEFDA23000-0x00007FFEFDA25000-memory.dmp

Filesize
8KB

Download
memory/4380-23-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/4380-72-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4380-69-0x0000000007BC0000-0x0000000007BC8000-memory.dmp

Filesize
32KB

Download
memory/4380-68-0x0000000007C70000-0x0000000007C8A000-memory.dmp

Filesize
104KB

Download
memory/4380-67-0x0000000007B90000-0x0000000007BA4000-memory.dmp

Filesize
80KB

Download
memory/4380-66-0x0000000007B80000-0x0000000007B8E000-memory.dmp

Filesize
56KB

Download
memory/4380-65-0x0000000007B40000-0x0000000007B51000-memory.dmp

Filesize
68KB

Download
memory/4380-64-0x0000000007BD0000-0x0000000007C66000-memory.dmp

Filesize
600KB

Download
memory/4380-63-0x00000000079B0000-0x00000000079BA000-memory.dmp

Filesize
40KB

Download
memory/4380-47-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Filesize
304KB

Download
memory/4380-60-0x0000000007800000-0x00000000078A3000-memory.dmp

Filesize
652KB

Download
memory/4380-58-0x00000000077D0000-0x00000000077EE000-memory.dmp

Filesize
120KB

Download
memory/4380-46-0x0000000007790000-0x00000000077C2000-memory.dmp

Filesize
200KB

Download
memory/4380-43-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/4380-24-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Filesize
408KB

Download
memory/4380-21-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4380-16-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4380-17-0x00000000056C0000-0x0000000005CE8000-memory.dmp

Filesize
6.2MB

Download
memory/4380-15-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4380-14-0x0000000005050000-0x0000000005086000-memory.dmp

Filesize
216KB

Download