xworm | 686900f495cffbd18b113fe3662e98c000a2a6365926ebe0d950c7d5d1b759c6

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jjjjj.exe
Size

693KB
MD5

4c138aeb4795fde4e3d9c5b2c6765521
SHA1

d49e76214ec5e269435765b7921b9f159205942b
SHA256

686900f495cffbd18b113fe3662e98c000a2a6365926ebe0d950c7d5d1b759c6
SHA512

93211f44410170fe7f48daf43688aa0190959386aae3e783e8b4a11d4be9e638a55aaa17b8227de330da0b5dbadc56a71079b627ec1b293990f0c44779df3d7c
SSDEEP

12288:cAxwxpi8hWPrmq9oheVVFPuUlk80CyyIsFcJzr:vx0rh8rmJAtuUSDa2

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

83.38.24.1:1603

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

Signatures

Detect Xworm Payload 8 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023cb1-6.dat	family_xworm
behavioral2/files/0x0007000000023cb5-17.dat	family_xworm
behavioral2/memory/528-33-0x0000000000FB0000-0x0000000000FDA000-memory.dmp	family_xworm
behavioral2/files/0x0007000000023cb6-38.dat	family_xworm
behavioral2/files/0x0007000000023cb7-47.dat	family_xworm
behavioral2/memory/2568-50-0x00000000006A0000-0x00000000006E2000-memory.dmp	family_xworm
behavioral2/memory/1972-51-0x0000000000FD0000-0x0000000000FF4000-memory.dmp	family_xworm
behavioral2/memory/384-32-0x0000000000F60000-0x0000000000F90000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3188	powershell.exe
4976	powershell.exe
1384	powershell.exe
1200	powershell.exe
4696	powershell.exe
4540	powershell.exe
2252	powershell.exe
3276	powershell.exe
1688	powershell.exe
2284	powershell.exe
4668	powershell.exe
680	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	jjjjj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	SearchFilterHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	OneDrive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	SecurityHealthSystray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe

Executes dropped EXE 16 IoCs

pid	Process
384	OneDrive.exe
528	SearchFilterHost.exe
2568	SecurityHealthSystray.exe
1972	WmiPrvSE.exe
4708	WmiPrvSE.exe
796	OneDrive.exe
3804	SearchFilterHost.exe
1848	SecurityHealthSystray.exe
548	OneDrive.exe
3308	SecurityHealthSystray.exe
4884	WmiPrvSE.exe
3504	SearchFilterHost.exe
3816	SecurityHealthSystray.exe
5072	OneDrive.exe
952	WmiPrvSE.exe
888	SearchFilterHost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost = "C:\\Users\\Admin\\SearchFilterHost.exe"	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\ProgramData\\WmiPrvSE.exe"	WmiPrvSE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\OneDrive.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\ProgramData\\SecurityHealthSystray.exe"	SecurityHealthSystray.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4084	schtasks.exe
3684	schtasks.exe
4424	schtasks.exe
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
4696	powershell.exe
4696	powershell.exe
4668	powershell.exe
4668	powershell.exe
4696	powershell.exe
4668	powershell.exe
2252	powershell.exe
2252	powershell.exe
680	powershell.exe
680	powershell.exe
2252	powershell.exe
1244	taskmgr.exe
1244	taskmgr.exe
680	powershell.exe
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe
4976	powershell.exe
4976	powershell.exe
3188	powershell.exe
4976	powershell.exe
3188	powershell.exe
3276	powershell.exe
3276	powershell.exe
3188	powershell.exe
3276	powershell.exe
1244	taskmgr.exe
1688	powershell.exe
1688	powershell.exe
1384	powershell.exe
1384	powershell.exe
1200	powershell.exe
1200	powershell.exe
2284	powershell.exe
2284	powershell.exe
1688	powershell.exe
1200	powershell.exe
1384	powershell.exe
2284	powershell.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	OneDrive.exe
Token: SeDebugPrivilege	528	SearchFilterHost.exe
Token: SeDebugPrivilege	2568	SecurityHealthSystray.exe
Token: SeDebugPrivilege	1972	WmiPrvSE.exe
Token: SeDebugPrivilege	1244	taskmgr.exe
Token: SeSystemProfilePrivilege	1244	taskmgr.exe
Token: SeCreateGlobalPrivilege	1244	taskmgr.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2568	SecurityHealthSystray.exe
Token: SeDebugPrivilege	1972	WmiPrvSE.exe
Token: SeDebugPrivilege	528	SearchFilterHost.exe
Token: SeDebugPrivilege	384	OneDrive.exe
Token: 33	1244	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1244	taskmgr.exe
Token: SeDebugPrivilege	1848	SecurityHealthSystray.exe
Token: SeDebugPrivilege	4708	WmiPrvSE.exe
Token: SeDebugPrivilege	796	OneDrive.exe
Token: SeDebugPrivilege	3804	SearchFilterHost.exe
Token: SeDebugPrivilege	548	OneDrive.exe
Token: SeDebugPrivilege	4884	WmiPrvSE.exe
Token: SeDebugPrivilege	3308	SecurityHealthSystray.exe
Token: SeDebugPrivilege	3504	SearchFilterHost.exe
Token: SeDebugPrivilege	3816	SecurityHealthSystray.exe
Token: SeDebugPrivilege	5072	OneDrive.exe
Token: SeDebugPrivilege	952	WmiPrvSE.exe
Token: SeDebugPrivilege	888	SearchFilterHost.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe
1244	taskmgr.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 384	1704	jjjjj.exe	84
PID 1704 wrote to memory of 384	1704	jjjjj.exe	84
PID 1704 wrote to memory of 528	1704	jjjjj.exe	85
PID 1704 wrote to memory of 528	1704	jjjjj.exe	85
PID 1704 wrote to memory of 2568	1704	jjjjj.exe	86
PID 1704 wrote to memory of 2568	1704	jjjjj.exe	86
PID 1704 wrote to memory of 1972	1704	jjjjj.exe	87
PID 1704 wrote to memory of 1972	1704	jjjjj.exe	87
PID 528 wrote to memory of 4696	528	SearchFilterHost.exe	93
PID 528 wrote to memory of 4696	528	SearchFilterHost.exe	93
PID 384 wrote to memory of 4668	384	OneDrive.exe	95
PID 384 wrote to memory of 4668	384	OneDrive.exe	95
PID 2568 wrote to memory of 680	2568	SecurityHealthSystray.exe	97
PID 2568 wrote to memory of 680	2568	SecurityHealthSystray.exe	97
PID 1972 wrote to memory of 2252	1972	WmiPrvSE.exe	98
PID 1972 wrote to memory of 2252	1972	WmiPrvSE.exe	98
PID 528 wrote to memory of 4540	528	SearchFilterHost.exe	101
PID 528 wrote to memory of 4540	528	SearchFilterHost.exe	101
PID 1972 wrote to memory of 3188	1972	WmiPrvSE.exe	103
PID 1972 wrote to memory of 3188	1972	WmiPrvSE.exe	103
PID 384 wrote to memory of 4976	384	OneDrive.exe	104
PID 384 wrote to memory of 4976	384	OneDrive.exe	104
PID 2568 wrote to memory of 3276	2568	SecurityHealthSystray.exe	107
PID 2568 wrote to memory of 3276	2568	SecurityHealthSystray.exe	107
PID 384 wrote to memory of 1384	384	OneDrive.exe	109
PID 384 wrote to memory of 1384	384	OneDrive.exe	109
PID 528 wrote to memory of 2284	528	SearchFilterHost.exe	111
PID 528 wrote to memory of 2284	528	SearchFilterHost.exe	111
PID 1972 wrote to memory of 1200	1972	WmiPrvSE.exe	112
PID 1972 wrote to memory of 1200	1972	WmiPrvSE.exe	112
PID 2568 wrote to memory of 1688	2568	SecurityHealthSystray.exe	113
PID 2568 wrote to memory of 1688	2568	SecurityHealthSystray.exe	113
PID 1972 wrote to memory of 4084	1972	WmiPrvSE.exe	119
PID 1972 wrote to memory of 4084	1972	WmiPrvSE.exe	119
PID 2568 wrote to memory of 3684	2568	SecurityHealthSystray.exe	120
PID 2568 wrote to memory of 3684	2568	SecurityHealthSystray.exe	120
PID 384 wrote to memory of 4424	384	OneDrive.exe	121
PID 384 wrote to memory of 4424	384	OneDrive.exe	121
PID 528 wrote to memory of 752	528	SearchFilterHost.exe	125
PID 528 wrote to memory of 752	528	SearchFilterHost.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jjjjj.exe
"C:\Users\Admin\AppData\Local\Temp\jjjjj.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\OneDrive.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
  "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchFilterHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\SearchFilterHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SearchFilterHost" /tr "C:\Users\Admin\SearchFilterHost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752
- C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\ProgramData\SecurityHealthSystray.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
  "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WmiPrvSE" /tr "C:\ProgramData\WmiPrvSE.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244

C:\Users\Admin\OneDrive.exe
C:\Users\Admin\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\ProgramData\SecurityHealthSystray.exe
C:\ProgramData\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\ProgramData\WmiPrvSE.exe
C:\ProgramData\WmiPrvSE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Users\Admin\SearchFilterHost.exe
C:\Users\Admin\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Users\Admin\OneDrive.exe
C:\Users\Admin\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Users\Admin\SearchFilterHost.exe
C:\Users\Admin\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\ProgramData\SecurityHealthSystray.exe
C:\ProgramData\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\ProgramData\WmiPrvSE.exe
C:\ProgramData\WmiPrvSE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\ProgramData\SecurityHealthSystray.exe
C:\ProgramData\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\ProgramData\WmiPrvSE.exe
C:\ProgramData\WmiPrvSE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Users\Admin\OneDrive.exe
C:\Users\Admin\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Users\Admin\SearchFilterHost.exe
C:\Users\Admin\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OneDrive.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b1a1d8b05525b7b0c5babfd80488c1f2

SHA1
c85bbd6b7d0143676916c20fd52720499c2bb5c6

SHA256
adad192fc86c2f939fd3f70cb9ad323139a4e100f7c90b4454e2c53bdbc9b705

SHA512
346c6513c1373bab58439e37d3f75de1c5c587d7eb27076cf696e885a027b3b38d70b585839d1a2e7f2270cdcf0dac8c1fdff799f3b1158242ae9e3364c2a06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
65a68df1062af34622552c4f644a5708

SHA1
6f6ecf7b4b635abb0b132d95dac2759dc14b50af

SHA256
718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

SHA512
4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b44a6a8555f13d3702ead46982e79773

SHA1
9c8789941a3d0f62e528db361919cbf26e6d3e6b

SHA256
0fcbd5ac9a99b069b819afb5dda282070ab8448d936103f1c0856aaf53e14b99

SHA512
72973d4273cdfd3e8a6d6290c308f1bbfdc93317db5dc958a71fbbeb22b2feacb0fe77937bb3b7e311b90ac816c983e352f274b9a829799644e2badebdfb209d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

Filesize
163KB

MD5
abd4141118794cd94979dc12bcded7b7

SHA1
27b11caedb23ea8dab4f36f5865a96e6e7f55806

SHA256
be9f4292935c19f00dcf2a6e09bc63f50cf7caad0d8ea0a45ed7bf86fb14e904

SHA512
d4ddda6b8ac66683e78b78360326ee50edf5edc8278a2f82e414545d4dd2a3d5e4269fe1dd884926b2e6d7e52af030f0b66fcca50cad77b8a31837ff482c4809

Download Submit
C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe

Filesize
145KB

MD5
40324e8a46ec891bcb5300f51ddfc335

SHA1
bc5c53d890371bd472c707da8e84c3925bf077d5

SHA256
cc7bcd68ad32d8490fd2d5217b5bace0068a7ebf96831f0373d88e27e6a3ff2c

SHA512
5b2c618234a6b14ea377604f08dd3c6f193be4f593f18b38ff9a3b88f939d61934c3ec4efca91ff98791051eeb79a53315168bfa0fe8466b60249f3bde9b86de

Download Submit
C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe

Filesize
243KB

MD5
f32ac010fcdbc8f8a5582c339ec9d9ea

SHA1
20c06c5a174504c4e28c9aa0b51a62ab8f5c70cb

SHA256
88835382ffaf3f7f0730a0a7edab3d3214cbbfdbc35e7269b80a6bd05b7edd18

SHA512
9798b196315a1e463105b811a0937f763ae21826fa9bd9f346059b5f0a573d48a6f4ed7174fb4551a4ae7ccd089c9cae90c30b38ef6e7c12e896138a0fcaa8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe

Filesize
124KB

MD5
16caf66537fe87d8d9b6a4eb34d9dbff

SHA1
4a399f4229ea5b27963d467223fd4ceb89e545f5

SHA256
64cc787990be5cdc1c25f5cdbfd2a0e93d4c68a888fefa0b7e2b0d12cea4de26

SHA512
a034dba721d36b5396dbe08a581d06c692c84edb0946e45073a8e3eb78a685ad42011b8ffa970190e673e94350dc1feef8d8f51908b53bc23a80536f75bba9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pgxz0kdw.vry.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk

Filesize
787B

MD5
549d1e9a1a78c0b2fcf70b664c977c43

SHA1
a61785fb8f3bfb7ff816baf2c2557de5d33e10a5

SHA256
5def5efe4465a2d4a953d6ce737c0ab749478c3b6fd4957d40ec0e89ce989233

SHA512
b2dddeb3d4b7d0e5b37944792d00ff99bd150c8a31db70b0a31d6e733faf0ddf1f43a97099b71f2d94bec2f0efc955e4dafe1b266901b46ec107254bfd12ac16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk

Filesize
827B

MD5
9ff27ae64b9db5fb2a3df6dedc12e3a4

SHA1
440d7ab0710e4d991269a511e5797d85c3278ddb

SHA256
43be0da810f1e6e7925e6b6f684b519ebc90e5937d7f6808dcb7f2a0bf77d4d6

SHA512
9a6d12c4046f5a3ec55a920d44a58b8a5fb75aa1edbdb8996a6dae54f8d7e869b315727be71a9f4d5a4ef3a193059d8d07c865c90a552779ad364b17b7b69ba0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk

Filesize
742B

MD5
322ea7dcf8fe7418b3bff158312008d5

SHA1
1f8a49ba3bff4c788c354271792acea618172e84

SHA256
eeb8af73f9d35eeda49b7cc849cc2902b2cb23d4f91b5eaf7a1f02fc0cb78611

SHA512
477798e406ed3b21bdea253450f1cdd7a39b58bc05510fcf15dc75b874dc55ef1e5ac5a28365cba94bb0efc60ebffc0ecbe1a643e443660e28ecceab33eac7c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk

Filesize
677B

MD5
c8172e3658022e2fe274b78906bb0036

SHA1
1f9b899fa6f8b31f96b77c6bdb1aeb3878ad90c0

SHA256
920ba5d5de7fdeb073017c22b3f2c975c092c7e4cb7c24e99b6bea04ddc1feae

SHA512
e472ba46afc02553352524963a411eb3f3404658087164b3297467c922f2b7403d7c17fe3fc600682324a2a4c7b66ea484c5f26ac52f215d9fc39c1ffe82d4da

Download Submit
memory/384-48-0x00007FFD4F7E0000-0x00007FFD502A1000-memory.dmp

Filesize
10.8MB

Download
memory/384-32-0x0000000000F60000-0x0000000000F90000-memory.dmp

Filesize
192KB

Download
memory/384-233-0x00007FFD4F7E0000-0x00007FFD502A1000-memory.dmp

Filesize
10.8MB

Download
memory/528-52-0x00007FFD4F7E0000-0x00007FFD502A1000-memory.dmp

Filesize
10.8MB

Download
memory/528-232-0x00007FFD4F7E0000-0x00007FFD502A1000-memory.dmp

Filesize
10.8MB

Download
memory/528-33-0x0000000000FB0000-0x0000000000FDA000-memory.dmp

Filesize
168KB

Download
memory/1244-59-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-64-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-65-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-54-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-55-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-53-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-60-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-63-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-61-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1244-62-0x000001EB49F00000-0x000001EB49F01000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x0000000000AF0000-0x0000000000BA4000-memory.dmp

Filesize
720KB

Download
memory/1704-0-0x00007FFD4F7E3000-0x00007FFD4F7E5000-memory.dmp

Filesize
8KB

Download
memory/1972-51-0x0000000000FD0000-0x0000000000FF4000-memory.dmp

Filesize
144KB

Download
memory/2568-50-0x00000000006A0000-0x00000000006E2000-memory.dmp

Filesize
264KB

Download
memory/4696-68-0x000001E761F20000-0x000001E761F42000-memory.dmp

Filesize
136KB

Download