xworm | 12f2da4d791bd7654bb4e89d48cef58c07e2b804be1c6f79ee3d68e9e9566906

Analysis

max time kernel
33s
max time network
34s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-11-2024 22:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

playit-0.9.4-signed.exe
Size

4.5MB
MD5

b5a2f8dde0d824b64b749f0db69d00d4
SHA1

2cf1025a87a2dee9972b71f54e399e37ae75e043
SHA256

12f2da4d791bd7654bb4e89d48cef58c07e2b804be1c6f79ee3d68e9e9566906
SHA512

107a05c44148d9b4c7ae597c94e1a99809addeb43ade7178effd83758bd443afbaf9d3008894c8e5834ac9acb308517097418bc8a5f9f0d50d25a373aa6637d6
SSDEEP

98304:yJd9khieA3BPOtdBrkFVYBh7IoAyTzZwFkQoGtczBOlzp2ybcBk:yJnkvAxPO3BrkFVYBKoASaFJekl92AcB

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

147.185.221.23:24311

Attributes

Install_directory
%AppData%
install_file
RegEdit.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0028000000045046-17.dat	family_xworm
behavioral1/memory/4984-31-0x0000000000E20000-0x0000000000E34000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1092	powershell.exe
1136	powershell.exe
3640	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	playit-0.9.4-signed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 3 IoCs

pid	Process
116	playit-0.9.3-signed.exe
4984	XClient.exe
5304	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fa8b933d-1a77-4721-b324-e2ea457b370a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241109225453.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "245"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3744	msedge.exe
3744	msedge.exe
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe
2700	identity_helper.exe
2700	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	XClient.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	powershell.exe
Token: SeSecurityPrivilege	1092	powershell.exe
Token: SeTakeOwnershipPrivilege	1092	powershell.exe
Token: SeLoadDriverPrivilege	1092	powershell.exe
Token: SeSystemProfilePrivilege	1092	powershell.exe
Token: SeSystemtimePrivilege	1092	powershell.exe
Token: SeProfSingleProcessPrivilege	1092	powershell.exe
Token: SeIncBasePriorityPrivilege	1092	powershell.exe
Token: SeCreatePagefilePrivilege	1092	powershell.exe
Token: SeBackupPrivilege	1092	powershell.exe
Token: SeRestorePrivilege	1092	powershell.exe
Token: SeShutdownPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeSystemEnvironmentPrivilege	1092	powershell.exe
Token: SeRemoteShutdownPrivilege	1092	powershell.exe
Token: SeUndockPrivilege	1092	powershell.exe
Token: SeManageVolumePrivilege	1092	powershell.exe
Token: 33	1092	powershell.exe
Token: 34	1092	powershell.exe
Token: 35	1092	powershell.exe
Token: 36	1092	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeIncreaseQuotaPrivilege	1136	powershell.exe
Token: SeSecurityPrivilege	1136	powershell.exe
Token: SeTakeOwnershipPrivilege	1136	powershell.exe
Token: SeLoadDriverPrivilege	1136	powershell.exe
Token: SeSystemProfilePrivilege	1136	powershell.exe
Token: SeSystemtimePrivilege	1136	powershell.exe
Token: SeProfSingleProcessPrivilege	1136	powershell.exe
Token: SeIncBasePriorityPrivilege	1136	powershell.exe
Token: SeCreatePagefilePrivilege	1136	powershell.exe
Token: SeBackupPrivilege	1136	powershell.exe
Token: SeRestorePrivilege	1136	powershell.exe
Token: SeShutdownPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeSystemEnvironmentPrivilege	1136	powershell.exe
Token: SeRemoteShutdownPrivilege	1136	powershell.exe
Token: SeUndockPrivilege	1136	powershell.exe
Token: SeManageVolumePrivilege	1136	powershell.exe
Token: 33	1136	powershell.exe
Token: 34	1136	powershell.exe
Token: 35	1136	powershell.exe
Token: 36	1136	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeIncreaseQuotaPrivilege	3640	powershell.exe
Token: SeSecurityPrivilege	3640	powershell.exe
Token: SeTakeOwnershipPrivilege	3640	powershell.exe
Token: SeLoadDriverPrivilege	3640	powershell.exe
Token: SeSystemProfilePrivilege	3640	powershell.exe
Token: SeSystemtimePrivilege	3640	powershell.exe
Token: SeProfSingleProcessPrivilege	3640	powershell.exe
Token: SeIncBasePriorityPrivilege	3640	powershell.exe
Token: SeCreatePagefilePrivilege	3640	powershell.exe
Token: SeBackupPrivilege	3640	powershell.exe
Token: SeRestorePrivilege	3640	powershell.exe
Token: SeShutdownPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeSystemEnvironmentPrivilege	3640	powershell.exe
Token: SeRemoteShutdownPrivilege	3640	powershell.exe
Token: SeUndockPrivilege	3640	powershell.exe
Token: SeManageVolumePrivilege	3640	powershell.exe
Token: 33	3640	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3744	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5636	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 116	2260	playit-0.9.4-signed.exe	82
PID 2260 wrote to memory of 116	2260	playit-0.9.4-signed.exe	82
PID 2260 wrote to memory of 4984	2260	playit-0.9.4-signed.exe	84
PID 2260 wrote to memory of 4984	2260	playit-0.9.4-signed.exe	84
PID 116 wrote to memory of 3744	116	playit-0.9.3-signed.exe	85
PID 116 wrote to memory of 3744	116	playit-0.9.3-signed.exe	85
PID 3744 wrote to memory of 3668	3744	msedge.exe	86
PID 3744 wrote to memory of 3668	3744	msedge.exe	86
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3840	3744	msedge.exe	87
PID 3744 wrote to memory of 3912	3744	msedge.exe	88
PID 3744 wrote to memory of 3912	3744	msedge.exe	88
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89
PID 3744 wrote to memory of 2752	3744	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\playit-0.9.4-signed.exe
"C:\Users\Admin\AppData\Local\Temp\playit-0.9.4-signed.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\playit-0.9.3-signed.exe
  "C:\Users\Admin\AppData\Local\Temp\playit-0.9.3-signed.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playit.gg/claim/c2a7d90bbb
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcfe1346f8,0x7ffcfe134708,0x7ffcfe134718
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x248,0x258,0x7ff7c66b5460,0x7ff7c66b5470,0x7ff7c66b5480
        5⤵
        
        PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10894794797691011721,16183348303935884325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
      4⤵
      PID:756
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- - C:\Windows\SYSTEM32\shutdown.exe
    shutdown.exe /f /s /t 0
    3⤵
    PID:5564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3588

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fe39d59-28ac-4e96-9e23-83a135cfceb5.tmp

Filesize
5KB

MD5
5cd994cbcc6bb7283921fc2c1982f1ed

SHA1
a7eeb7e30cdf378d58bf7fc6264f0ab74cd10985

SHA256
a5646a7491a0e84253761428c676351192cf0c45b9bd6ebfce70f46d23152d1a

SHA512
e607f613b8ea4ef377dd2c3c3deafc70b0c793c60a350440ea4a8827ce4704382cde5f001f38cc1dbcea29eb0277ef6c64fd85a4dcb3f31ed517d712e24b5c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
e4d32c3014952ab5caf122844ed44e30

SHA1
b36975db43f6218a15546f9e0662e16209da0246

SHA256
a930096ce907b769621aee3835f2e5bedfccd8d0735d298cb62cbe366ddd7d51

SHA512
38ef63a7c9c72b70c1cea7f8b15eb0534745ae15bd4a93f3798a9756e161edea38dbb6ef800ebb55503cbbf633acefb596d6cdb73cdfe9d42a536b49bd933184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b3e303b42303c3a19ce77f2b9f01642

SHA1
351d62d6c9d502206b4a23395912bed8193fa871

SHA256
eab5912e5582c85949cea437c56905a195373aa6ebcc9fec79f5a31e67e813f2

SHA512
cdec85a558ca06f81ed29c1c1dbf47c5cc25423395c46f7e34bb9539fc43ee6d3588d64b55e5bb990f7ec88b08b26a27c368bfdc7ea6a46f3c250be1f33d282a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dcb673d2caa7bbf13d90893b5e6d5d5d

SHA1
ef6e8d78f62068e2ee7bca6d7968c77058220379

SHA256
31e0bd6f7da98ac77794c5f172bd69668ef4cead491d1b39654d0d813ecce4b6

SHA512
fad480b9b357a74c5cf805bb391e50bc2decc3c1423d5f9e580d6618fe1abdb71258ad5a5ba4c65342a44be28b80ea23d98b59fccf70a8f551f13af2e48e3e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6f69ecb3fbecc3999e0c21b487b98ead

SHA1
7a5c56452c15581fe215bb57283d0462c10affd6

SHA256
fc5d87bc2b74258f9c1db7a4a78df502371ef30b0ee8c5cbed8fc000d8f1041b

SHA512
022bbe3eea838d22a63d457c16d8f4e4a44205f9388550eae8c1edf0e11e5a5551e52965298d60dda1fdbad3503bb5bdf9bb7d877e03ab2d573adbd108307155

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
57KB

MD5
f2a9ba24fda65a5e298a37965de4258f

SHA1
5c91e7c89233c45933ac106cd4d1110d293c9206

SHA256
6ea59e69f350e9f0311dfc3d58fcc3ebd22f2401b3047f454a518e73a12569dd

SHA512
e53b4e702ba04350d3c5f4c3780394b53360100b67f9856831a49235d1561cb864616823be3308911629416a5e69d88f2c3fdff8907547a9d821714e1eb94386

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1jobdzr.1xt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\playit-0.9.3-signed.exe

Filesize
13.1MB

MD5
da0750733bf36c61222eefaba4805dcb

SHA1
304e90d123300e646b768f1f358e59ba506b7dce

SHA256
c9ff8f05cdde137cb0e1e386184a42d4889988c4cfd235fd3340fe545f5e06ac

SHA512
f9a8e89f294257f785388e237a6da1f363f8d78af7c9b473d67261b99526224eb84598eacbba17f01a9f2eb2f6fea0740f7e37df92891df8fa39a33820287454

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c9b0032967f37363b241980c46427f43

SHA1
d4856473fed3d06f5401e60ebdc90e8068061901

SHA256
1aaef6236d8fa192f43fb0d4697c13662dece48359f62e6c711340b57230870c

SHA512
d24ea0b14e106d47ca7c3e8958e69df52fa58699cac07d325f04c2fb3bc97b44e61671cd7b55ed6e9117a929a218911f8d932813061df5e09ec11b5f2b0737f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
314f92fb33bb6856ad12857c42a1e265

SHA1
b95cc8185e906a937493f038dfe3ff2fa489fffe

SHA256
777ebc69e0ccaeb48e65025e471187fcc64785295e8b2071c0e2b6b11984ba10

SHA512
247d100872cf9b86bde591a77ccc4de0e7815d777e14eb7466170bca620edfd9e0cf27c294093b3c26cf718654885f2167e2b6faf79014eef54def1a653d92bc

Download Submit
memory/116-211-0x0000000000400000-0x0000000000C1E000-memory.dmp

Filesize
8.1MB

Download
memory/116-294-0x0000000000400000-0x0000000000C1E000-memory.dmp

Filesize
8.1MB

Download
memory/116-304-0x0000000000400000-0x0000000000C1E000-memory.dmp

Filesize
8.1MB

Download
memory/1092-124-0x0000027C4F9C0000-0x0000027C4F9E2000-memory.dmp

Filesize
136KB

Download
memory/2260-0-0x00007FFCFF753000-0x00007FFCFF755000-memory.dmp

Filesize
8KB

Download
memory/2260-29-0x00007FFCFF750000-0x00007FFD00212000-memory.dmp

Filesize
10.8MB

Download
memory/2260-2-0x00007FFCFF750000-0x00007FFD00212000-memory.dmp

Filesize
10.8MB

Download
memory/2260-1-0x0000000000850000-0x0000000000CD2000-memory.dmp

Filesize
4.5MB

Download
memory/4984-32-0x00007FFCFF750000-0x00007FFD00212000-memory.dmp

Filesize
10.8MB

Download
memory/4984-212-0x00007FFCFF750000-0x00007FFD00212000-memory.dmp

Filesize
10.8MB

Download
memory/4984-31-0x0000000000E20000-0x0000000000E34000-memory.dmp

Filesize
80KB

Download
memory/4984-323-0x00007FFCFF750000-0x00007FFD00212000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads