xworm | fc61030b2b9431b0bb5f1a39e4d2a225fd737f143a7f7bf552aaed1ea9a8549e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-11-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Api-AutoUpdater-Click-yes.exe
Size

205KB
MD5

d56646c8251432a184a2154302512e29
SHA1

acfa04f7245e24eac7f452fb576ccc606655418f
SHA256

fc61030b2b9431b0bb5f1a39e4d2a225fd737f143a7f7bf552aaed1ea9a8549e
SHA512

566a51751e6bdc67fb06d4bce8ce2141298475e34b6fdcdba42de2ca74eb02c19b10962707eb6bb96cc6f7ce202130b3d16a64b4feb4578a6cfaa322fefb57db
SSDEEP

6144:7SncRl9Fb3g/7CbCR5F5I5eJAdbyVTqkbtP:e4LZg/OoFS5Fbw

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

job-moore.gl.at.ply.gg:49404

Attributes

Install_directory
%ProgramData%
install_file
Helper.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0009000000029d3e-4.dat	family_xworm
behavioral1/memory/448-23-0x00000000008A0000-0x00000000008B6000-memory.dmp	family_xworm
behavioral1/memory/3032-101-0x000000001BD40000-0x000000001BD56000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3856	powershell.exe
3880	powershell.exe
3384	powershell.exe
2408	powershell.exe
4832	powershell.exe
3576	powershell.exe
3292	powershell.exe
1612	powershell.exe
2344	powershell.exe
1688	powershell.exe
3276	powershell.exe
3388	powershell.exe
4384	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	API-AUTOUPDATER.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	API-AUTOUPDATER.EXE

Executes dropped EXE 6 IoCs

pid	Process
448	API-AUTOUPDATER.EXE
3032	API-AUTOUPDATERV2.EXE
392	API-AUTOUPDATERV2.EXE
3580	WindowsDefender
1568	API-AUTOUPDATERV2.EXE
4868	WindowsDefender

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\ProgramData\\WindowsDefender"	API-AUTOUPDATER.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Api-AutoUpdater-Click-yes.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1944	schtasks.exe
3620	schtasks.exe
2104	schtasks.exe
868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe
3384	powershell.exe
3384	powershell.exe
2408	powershell.exe
2408	powershell.exe
4832	powershell.exe
4832	powershell.exe
3576	powershell.exe
3576	powershell.exe
1688	powershell.exe
1688	powershell.exe
3292	powershell.exe
3292	powershell.exe
448	API-AUTOUPDATER.EXE
3856	powershell.exe
3856	powershell.exe
3276	powershell.exe
3276	powershell.exe
3388	powershell.exe
3388	powershell.exe
4384	powershell.exe
4384	powershell.exe
3880	powershell.exe
3880	powershell.exe
1612	powershell.exe
1612	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3996	msinfo32.exe
2060	msinfo32.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	API-AUTOUPDATER.EXE
Token: SeDebugPrivilege	3032	API-AUTOUPDATERV2.EXE
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	448	API-AUTOUPDATER.EXE
Token: SeDebugPrivilege	392	API-AUTOUPDATERV2.EXE
Token: SeDebugPrivilege	3580	WindowsDefender
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	1568	API-AUTOUPDATERV2.EXE
Token: SeDebugPrivilege	4868	WindowsDefender
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
448	API-AUTOUPDATER.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 448	3480	Api-AutoUpdater-Click-yes.exe	79
PID 3480 wrote to memory of 448	3480	Api-AutoUpdater-Click-yes.exe	79
PID 3480 wrote to memory of 3032	3480	Api-AutoUpdater-Click-yes.exe	80
PID 3480 wrote to memory of 3032	3480	Api-AutoUpdater-Click-yes.exe	80
PID 448 wrote to memory of 2344	448	API-AUTOUPDATER.EXE	83
PID 448 wrote to memory of 2344	448	API-AUTOUPDATER.EXE	83
PID 3032 wrote to memory of 3384	3032	API-AUTOUPDATERV2.EXE	85
PID 3032 wrote to memory of 3384	3032	API-AUTOUPDATERV2.EXE	85
PID 448 wrote to memory of 2408	448	API-AUTOUPDATER.EXE	87
PID 448 wrote to memory of 2408	448	API-AUTOUPDATER.EXE	87
PID 3032 wrote to memory of 4832	3032	API-AUTOUPDATERV2.EXE	89
PID 3032 wrote to memory of 4832	3032	API-AUTOUPDATERV2.EXE	89
PID 448 wrote to memory of 3576	448	API-AUTOUPDATER.EXE	91
PID 448 wrote to memory of 3576	448	API-AUTOUPDATER.EXE	91
PID 3032 wrote to memory of 1688	3032	API-AUTOUPDATERV2.EXE	93
PID 3032 wrote to memory of 1688	3032	API-AUTOUPDATERV2.EXE	93
PID 448 wrote to memory of 3292	448	API-AUTOUPDATER.EXE	95
PID 448 wrote to memory of 3292	448	API-AUTOUPDATER.EXE	95
PID 3032 wrote to memory of 1944	3032	API-AUTOUPDATERV2.EXE	97
PID 3032 wrote to memory of 1944	3032	API-AUTOUPDATERV2.EXE	97
PID 448 wrote to memory of 3620	448	API-AUTOUPDATER.EXE	99
PID 448 wrote to memory of 3620	448	API-AUTOUPDATER.EXE	99
PID 392 wrote to memory of 3856	392	API-AUTOUPDATERV2.EXE	105
PID 392 wrote to memory of 3856	392	API-AUTOUPDATERV2.EXE	105
PID 392 wrote to memory of 3276	392	API-AUTOUPDATERV2.EXE	107
PID 392 wrote to memory of 3276	392	API-AUTOUPDATERV2.EXE	107
PID 392 wrote to memory of 3388	392	API-AUTOUPDATERV2.EXE	109
PID 392 wrote to memory of 3388	392	API-AUTOUPDATERV2.EXE	109
PID 392 wrote to memory of 2104	392	API-AUTOUPDATERV2.EXE	111
PID 392 wrote to memory of 2104	392	API-AUTOUPDATERV2.EXE	111
PID 1568 wrote to memory of 4384	1568	API-AUTOUPDATERV2.EXE	116
PID 1568 wrote to memory of 4384	1568	API-AUTOUPDATERV2.EXE	116
PID 1568 wrote to memory of 3880	1568	API-AUTOUPDATERV2.EXE	118
PID 1568 wrote to memory of 3880	1568	API-AUTOUPDATERV2.EXE	118
PID 1568 wrote to memory of 1612	1568	API-AUTOUPDATERV2.EXE	120
PID 1568 wrote to memory of 1612	1568	API-AUTOUPDATERV2.EXE	120
PID 1568 wrote to memory of 868	1568	API-AUTOUPDATERV2.EXE	122
PID 1568 wrote to memory of 868	1568	API-AUTOUPDATERV2.EXE	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdater-Click-yes.exe
"C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdater-Click-yes.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATER.EXE
  "C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATER.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATER.EXE'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'API-AUTOUPDATER.EXE'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsDefender'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsDefender" /tr "C:\ProgramData\WindowsDefender"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATERV2.EXE
  "C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATERV2.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'API-AUTOUPDATERV2.EXE'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATERV2.EXE'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\API-AUTOUPDATERV2.EXE'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "API-AUTOUPDATERV2" /tr "C:\ProgramData\API-AUTOUPDATERV2.EXE"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1944

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\RepairInitialize.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:3996

C:\ProgramData\API-AUTOUPDATERV2.EXE
C:\ProgramData\API-AUTOUPDATERV2.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3388
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "API-AUTOUPDATERV2" /tr "C:\ProgramData\API-AUTOUPDATERV2.EXE"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2104

C:\ProgramData\WindowsDefender
C:\ProgramData\WindowsDefender
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\MountExpand.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2060

C:\ProgramData\API-AUTOUPDATERV2.EXE
C:\ProgramData\API-AUTOUPDATERV2.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\API-AUTOUPDATERV2.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "API-AUTOUPDATERV2" /tr "C:\ProgramData\API-AUTOUPDATERV2.EXE"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:868

C:\ProgramData\WindowsDefender
C:\ProgramData\WindowsDefender
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\API-AUTOUPDATERV2.EXE.log

Filesize
1KB

MD5
1fe5defe931b8c5d85bf1d61aaa97241

SHA1
d8bcc82b9ffdf43be83c90f4228e2e0700c1715d

SHA256
3f10eef20974492aef0b2feb071a059a1645b254675d8bd575a5abb94df36ea0

SHA512
7a1fc310d678e8f971eed429d7ac09ca0ea7148825f50c45bde4674e629d483c38ecdc7f907b6981c7a733781c242ca07c1b0db32c47ed5a42267dbdc8d6f982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsDefender.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4914eb0b2ff51bfa48484b5cc8454218

SHA1
6a7c3e36ce53b42497884d4c4a3bda438dd4374b

SHA256
7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e

SHA512
83ab35f622f4a5040ca5cb615a30f83bb0741449225f1fd1815b6923e225c28241d0c02d34f83f743349a5e57f84ca1c6f44016797a93d5985be41d11be79500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e47c3fa11e796c492a8388c946bf1636

SHA1
4a090378f0db26c6f019c9203f5b27f12fa865c7

SHA256
4bb861850395dcc3bec4691e8b9f0fa733b8a2d568d460a9201d65250b12fee1

SHA512
8d4af4eba3019cd060561f42cff11374eafe59da5e5ad677e41d0b9198b87d6d13706e760d13c70574ed1384993a1597f886d21fe6ecd0186379a1e93db30695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
80b42fe4c6cf64624e6c31e5d7f2d3b3

SHA1
1f93e7dd83b86cb900810b7e3e43797868bf7d93

SHA256
ee20a5b38a6674366efda276dbbf0b43eb54efd282acfc1033042f6b53a80d4d

SHA512
83c1c744c15a8b427a1d3af677ec3bfd0353875a60fe886c41570981e17467ebbb59619b960ca8c5c3ab1430946b0633ea200b7e7d84ab6dca88b60c50055573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e07eea85a8893f23fb814cf4b3ed974c

SHA1
8a8125b2890bbddbfc3531d0ee4393dbbf5936fe

SHA256
83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea

SHA512
9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
781da0576417bf414dc558e5a315e2be

SHA1
215451c1e370be595f1c389f587efeaa93108b4c

SHA256
41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

SHA512
24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
051a74485331f9d9f5014e58ec71566c

SHA1
4ed0256a84f2e95609a0b4d5c249bca624db8fe4

SHA256
3f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888

SHA512
1f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
050567a067ffea4eb40fe2eefebdc1ee

SHA1
6e1fb2c7a7976e0724c532449e97722787a00fec

SHA256
3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

SHA512
341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

Download Submit
C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATER.EXE

Filesize
65KB

MD5
282ddc7563c0d9ba376efe55170d8e14

SHA1
be7da0a7914fd8988e61ca2a4152aeef5fb1272c

SHA256
0c41c04429fab2ee34432bbaad69397df6efdce744b77173fa8353d38b652f66

SHA512
f07b87b10840ba1941afb0387229ea01a50a2a2aea925bc4f731b594f51d3b51582774ab9e32c885174b77dfae075b2fefb820ef29563ba8f670b2a2baf6cb9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\API-AUTOUPDATERV2.EXE

Filesize
87KB

MD5
9f9e3e562c3ace91fd36c7d9b49c56a7

SHA1
32317350629c0591b49726ad71ab49e12b208918

SHA256
c2306587c0e582a16037717598479523ba07d1afb646ab4a4ab63173adaaa971

SHA512
8a60f2a143475fed2837a670717c5e35bcb0c0602fd633cda4efdfdd95ae15c407077fca5b7e5ac1dd771acc994f7f3b3fdff589dc3f613bce6144cdc3c7df8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aks02mvf.vfd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/448-27-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/448-109-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/448-23-0x00000000008A0000-0x00000000008B6000-memory.dmp

Filesize
88KB

Download
memory/448-20-0x00007FFCFF133000-0x00007FFCFF135000-memory.dmp

Filesize
8KB

Download
memory/2344-33-0x00000241563E0000-0x0000024156402000-memory.dmp

Filesize
136KB

Download
memory/3032-26-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/3032-108-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/3032-107-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/3032-105-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/3032-101-0x000000001BD40000-0x000000001BD56000-memory.dmp

Filesize
88KB

Download
memory/3032-25-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/3032-24-0x0000000000170000-0x000000000018C000-memory.dmp

Filesize
112KB

Download