xworm | 6310587b2cc186e0ad7b38e89843b3cf32af112a07e974868d2ec7e36fb39f10

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
30-09-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quantis V1.4/Microsoft.Web.WebView2.Core.dll
Size

557KB
MD5

b037ca44fd19b8eedb6d5b9de3e48469
SHA1

1f328389c62cf673b3de97e1869c139d2543494e
SHA256

11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
SHA512

fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP

12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

ydvXWMer35mRfdLm

Attributes

Install_directory
%AppData%
install_file
taskhostw.exe
pastebin_url
https://pastebin.com/raw/BE52BVvz

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4172-535-0x0000000000990000-0x00000000009A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
3860	msedge.exe
3860	msedge.exe
3864	identity_helper.exe
3864	identity_helper.exe
3796	msedge.exe
3796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	Quantis.exe
Token: SeDebugPrivilege	724	Quantis.exe
Token: SeDebugPrivilege	460	Quantis.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4116	3860	msedge.exe	82
PID 3860 wrote to memory of 4116	3860	msedge.exe	82
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 3564	3860	msedge.exe	83
PID 3860 wrote to memory of 764	3860	msedge.exe	84
PID 3860 wrote to memory of 764	3860	msedge.exe	84
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85
PID 3860 wrote to memory of 4964	3860	msedge.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Microsoft.Web.WebView2.Core.dll",#1
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d5c73cb8,0x7ff8d5c73cc8,0x7ff8d5c73cd8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14003081056879310026,1596141503146613135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe
"C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe
"C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe
"C:\Users\Admin\AppData\Local\Temp\Quantis V1.4\Quantis.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
9ebfbd198a17aaa99945edc1f9b80cc6

SHA1
6e6294a2b27a5b4f5fe92048678a1dada2a2e13c

SHA256
6a28c54a0df01f00dee95724e98f23dedf89afbc53c83a86b493e315f9c89411

SHA512
8dcbb76afc063523be3d25ebd69bbd44b745001e3ed5aff51feeb92ae461ec50337c6627abfa507971a145f2af3860da11324c4d51ccece8970f619d0acad7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
eba690ec569d493030120838585e8842

SHA1
64145511d3ccf1f13f8cb461c8a822c5a3a9d2d6

SHA256
a1ba324f714766a8e751743b609efe5b4313fd2fd699a487fb47b5c464ac8544

SHA512
266d28fd7f94e181e8fbd8e2cb434dfcad16c3c9fac2ef97e1a05e05e21206870381a04348ccb6e3c72ce8975ac42600c0d0eb271b9444135fd61e451f08bdde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
70abd4d2bc894b925c4bd1c3d17cf62a

SHA1
1fd4caa77f248bfc4e6657a40d3765ea900881da

SHA256
0d8961b5c0d9f1a4417cdcda4eb2e3fa6cb10ad56c7d146801ee5391e46865c7

SHA512
4d7146bd9acf35c946aedcfc1d453509f72ddc01e37c1fbdf9d746831405910568863eaa42cc24c332d801986fc0c3327821c7f57a4d1f5b78991dd0994b3c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3de85a45d9a4c6d5f2751cbb94c5675

SHA1
e0096016bb5d96cf26598d6a206f27ab02f8b9f8

SHA256
8785537473509a03e5c5d67e12aa6366d7c631ceb367b4922be8a79501dcdcef

SHA512
aecbfe0275f47e7dec57bfb0b9e2b99eeeb490e93cf59d89373c9199e8478365b1057322087fd38ad560f63d2ed19871abf8a3f625e65597afaa8ddb4c994ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9c924b20c673b6d856fe5ad464be884

SHA1
4aaf5b21aa93cb1031a33f6c4ab3766988e31cce

SHA256
52ad1c40f1ead9553868f9e2a88136f0cec368656a90bc141cc2e61fd3f992be

SHA512
b190c9bb348d8119e42d677772b2b2500bcaa95a6c807f417959bae99774fac26db83160899801f59ac67e7685593eed7d480f7d942abfbdbf5a1d669c76e495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9f8070a5d8468ed6b9a5dac20853ae2

SHA1
1e9252dc196a1a4685c0f5caf178a7f88cb11e8f

SHA256
0be3e7e17c1aeeca5fecf019cfd1e6d5d156097e1e44b8dac23d4a0fe0c885a6

SHA512
02ba2a0381bdc6edd11d3d416ad6996a477eec54b4265d208935cf77f212cc51ca2b320858a50cd0f670a08c310e0a013fd72c407c60e9e6de351e9dad1b9513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee3e9de8c18d4f15791869b9433578bc

SHA1
99eed3fee96c54dd89fda06f5df0e42d4eb670ec

SHA256
7abe19c07efa59e665dcab014cdec683eadc69c983b5d3ad28b1f4db2b676e99

SHA512
e13f2e3fb6b29abd6ef5cf601769616637056ea7a87e5fc79b344e983fb863153146966bc327258bed1a3aac224f6cbae7b136d71f47097994ba5a1936dc0202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd705861cf952a88abae1210899dbe42

SHA1
9a9a4e7ba33389e9e7c9a7a7889118da5154ec5a

SHA256
aabbaacdfb3b02f5bd576dc5a55d5b30ee84903a84577ea848d84f90fb43fe3a

SHA512
afc409fe0f34a36a8f2add0d92c7e21311fa475ff5e6fcbc78e00dcfc2946200d4ded8285a68049f414dada84de2b5f9e878e28e10e23f983f8a807f6c8b5c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588364.TMP

Filesize
534B

MD5
d844a636baebba9eaee85d1d56331dcf

SHA1
ec29a0f69133bc23cfe6e4f8cc785436e0036344

SHA256
9595b7027fa789743d0ab80482a36453d0fea5ea1f62513bc006a0626c8c095d

SHA512
29c27516e4b91868f95b07f65954796662719c8e229c8c1d417076666c33785b18bb2f9fc2e330a47cbe9a5db773eb1a078858c1d3a5daefdebf3d5151a0d12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
06faaa9a71a26f73acd70a7f72a4a4e6

SHA1
7ae8aca7dd0834de3df84aa96892b2e5bfeb5ebd

SHA256
93b212ec0fde15df7e2554ebe440fcedc473f95bc214ab566ff420bcf66fc59e

SHA512
859401f87be6898b82cc56a71d03777e4cab821088e8f7eeb89174a85d02c6ec262af13bd524145b1c7625a41638750dc1533ede1cb45ddcd8a6297895432f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38de9c37e197ce9c731c3deed7f57c46

SHA1
15dd8a4b1e63734e8a6bf9412ea06acc725f5aca

SHA256
e957d2d7c2f512cf90aeeca6b72b0adbcfaeab66a69edf8ee5c0591754b9d691

SHA512
e0409e31df42fbbcf26916ed307a167334052b55574ef5a16c7a2e8cd4a24e0f1f0bf56eac761a2700f829b8dc6b645f71e7b1c647714d180224aeeefc80e071

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
a8b8237fc055f848630c92124b8b19f4

SHA1
0257ba6386b777b69b59443c5f8e7a98db7f910c

SHA256
7932f43cc82ca06adae53f8dd679c4d99a52427aaa1a6ed84eb55c253b4ed14b

SHA512
3ccefa4ebedbe5795888e06bbfa84fd9e941fb396db44acf76b8ac9946bdd1b46ec2c04aea80e7fae807de6bc0ed9f1a35bca61f1622dc8b8f05fa19f2014a8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ca7472ceaf97768acc6ace62be76f682

SHA1
cd16c443726113fee6edaba9fe9f0e217a932161

SHA256
f935ab4b555ca08449cde7a27243a766c9db218bf078e308d080eabdd27042c8

SHA512
76e29dc69fa14a75f9c14b777020791c7e4685b268c489daf85837695a5f0dd2f7b7e596409ab8dae0e9d02170dddc65f9f8463d6b4d3ceb20fc0041f8d4715f

Download Submit
memory/4172-535-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download