Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
45s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/01/2025, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
XWorm V6.0.exe
Resource
win11-20241007-en
General
-
Target
XWorm V6.0.exe
-
Size
21.6MB
-
MD5
ba23d65ef70b05cd3b04dfcbbd801059
-
SHA1
5c241dc3d79f61bdf82d091bfe29bca2e641d802
-
SHA256
0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d
-
SHA512
d32a4838ca544b9b4764bb99b716faf797aa194199151426a8848c1ed27b5f2428629324d30f15db138ff56d34d46233e3ef106ad416eff29de43eb8ade0eff9
-
SSDEEP
393216:6JSgxj4gebngiHe2bD616QWBbdw6s8qaPNL1Zjo7YOiFSbzPQWrGMYV3j+cintc:4agiHe2n61Ub1fqY1Z8WSPFrlNHnt
Malware Config
Extracted
xworm
5.0
WcpxqjjxSrB6UOUw
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/RPPi3ByL
-
telegram
https://api.telegram.org/bot7483240807:AAHWuUBi6sW9ZOb0kfXVbzbMVyLtPj-9vZY/sendMessage?chat_id=5279018187
Extracted
asyncrat
1.0.7
Default
51.89.44.68:8848
etb3t1tr5n
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
Extracted
gurcu
https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/getM
https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/sendMessage?chat_id=8169552647
Signatures
-
Asyncrat family
-
Detect Xworm Payload 6 IoCs
resource yara_rule behavioral1/files/0x001c00000002aa68-6.dat family_xworm behavioral1/files/0x001c00000002aaa1-18.dat family_xworm behavioral1/memory/4996-32-0x0000000000510000-0x000000000053C000-memory.dmp family_xworm behavioral1/files/0x001a00000002aab9-34.dat family_xworm behavioral1/memory/4352-37-0x00000000001D0000-0x00000000001FE000-memory.dmp family_xworm behavioral1/memory/4456-36-0x00000000006A0000-0x00000000006C8000-memory.dmp family_xworm -
Gurcu family
-
Xworm family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x001d00000002aabd-155.dat family_asyncrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1224 powershell.exe 1896 powershell.exe 1604 powershell.exe 2552 powershell.exe 3140 powershell.exe 2184 powershell.exe 4568 powershell.exe 72 powershell.exe 2876 powershell.exe 2344 powershell.exe 2028 powershell.exe 1536 powershell.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 7 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1260 chrome.exe 2844 chrome.exe 3096 chrome.exe 2368 chrome.exe 3528 chrome.exe 1104 msedge.exe 8 msedge.exe -
Drops startup file 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Chrome Update.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk OneDrive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk OneDrive.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk msedge.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk msedge.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk msedge.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Chrome Update.exe -
Executes dropped EXE 13 IoCs
pid Process 4996 Chrome Update.exe 4456 OneDrive.exe 4352 msedge.exe 2480 Xworm V5.6.exe 2456 update.dotnet.exe 3356 svchost.exe 2476 svchost.exe 1196 svchost.exe 2496 svchost.exe 4232 XClient.exe 1580 OneDrive.exe 3324 msedge.exe 4480 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 update.dotnet.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 update.dotnet.exe Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 update.dotnet.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" Chrome Update.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\ProgramData\\OneDrive.exe" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 30 IoCs
flow ioc 60 pastebin.com 3 pastebin.com 7 pastebin.com 11 pastebin.com 38 pastebin.com 51 pastebin.com 55 pastebin.com 14 pastebin.com 48 pastebin.com 1 raw.githubusercontent.com 6 pastebin.com 39 pastebin.com 8 pastebin.com 30 pastebin.com 53 pastebin.com 59 pastebin.com 2 raw.githubusercontent.com 29 pastebin.com 61 pastebin.com 52 pastebin.com 4 pastebin.com 5 pastebin.com 9 pastebin.com 10 pastebin.com 13 pastebin.com 50 pastebin.com 1 pastebin.com 44 pastebin.com 49 pastebin.com 54 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 icanhazip.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3592 cmd.exe 4800 netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 update.dotnet.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier update.dotnet.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1360 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
pid Process 2404 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133816876096854586" chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3156 schtasks.exe 3020 schtasks.exe 1212 schtasks.exe 3924 schtasks.exe 5032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1896 powershell.exe 1224 powershell.exe 1224 powershell.exe 1896 powershell.exe 2876 powershell.exe 2344 powershell.exe 2876 powershell.exe 2344 powershell.exe 1604 powershell.exe 2028 powershell.exe 1604 powershell.exe 2028 powershell.exe 2552 powershell.exe 3140 powershell.exe 2552 powershell.exe 3140 powershell.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 2456 update.dotnet.exe 1260 chrome.exe 1260 chrome.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 2456 update.dotnet.exe 3152 msedge.exe 3152 msedge.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4964 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1260 chrome.exe 1260 chrome.exe 1260 chrome.exe 1260 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 Chrome Update.exe Token: SeDebugPrivilege 4456 OneDrive.exe Token: SeDebugPrivilege 4352 msedge.exe Token: SeDebugPrivilege 2456 update.dotnet.exe Token: SeDebugPrivilege 1896 powershell.exe Token: SeDebugPrivilege 1224 powershell.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeIncreaseQuotaPrivilege 3356 svchost.exe Token: SeSecurityPrivilege 3356 svchost.exe Token: SeTakeOwnershipPrivilege 3356 svchost.exe Token: SeLoadDriverPrivilege 3356 svchost.exe Token: SeSystemProfilePrivilege 3356 svchost.exe Token: SeSystemtimePrivilege 3356 svchost.exe Token: SeProfSingleProcessPrivilege 3356 svchost.exe Token: SeIncBasePriorityPrivilege 3356 svchost.exe Token: SeCreatePagefilePrivilege 3356 svchost.exe Token: SeBackupPrivilege 3356 svchost.exe Token: SeRestorePrivilege 3356 svchost.exe Token: SeShutdownPrivilege 3356 svchost.exe Token: SeDebugPrivilege 3356 svchost.exe Token: SeSystemEnvironmentPrivilege 3356 svchost.exe Token: SeRemoteShutdownPrivilege 3356 svchost.exe Token: SeUndockPrivilege 3356 svchost.exe Token: SeManageVolumePrivilege 3356 svchost.exe Token: 33 3356 svchost.exe Token: 34 3356 svchost.exe Token: 35 3356 svchost.exe Token: 36 3356 svchost.exe Token: SeIncreaseQuotaPrivilege 2476 svchost.exe Token: SeSecurityPrivilege 2476 svchost.exe Token: SeTakeOwnershipPrivilege 2476 svchost.exe Token: SeLoadDriverPrivilege 2476 svchost.exe Token: SeSystemProfilePrivilege 2476 svchost.exe Token: SeSystemtimePrivilege 2476 svchost.exe Token: SeProfSingleProcessPrivilege 2476 svchost.exe Token: SeIncBasePriorityPrivilege 2476 svchost.exe Token: SeCreatePagefilePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeShutdownPrivilege 2476 svchost.exe Token: SeDebugPrivilege 2476 svchost.exe Token: SeSystemEnvironmentPrivilege 2476 svchost.exe Token: SeRemoteShutdownPrivilege 2476 svchost.exe Token: SeUndockPrivilege 2476 svchost.exe Token: SeManageVolumePrivilege 2476 svchost.exe Token: 33 2476 svchost.exe Token: 34 2476 svchost.exe Token: 35 2476 svchost.exe Token: 36 2476 svchost.exe Token: SeDebugPrivilege 4964 taskmgr.exe Token: SeSystemProfilePrivilege 4964 taskmgr.exe Token: SeCreateGlobalPrivilege 4964 taskmgr.exe Token: SeShutdownPrivilege 1260 chrome.exe Token: SeCreatePagefilePrivilege 1260 chrome.exe Token: SeShutdownPrivilege 1260 chrome.exe Token: SeCreatePagefilePrivilege 1260 chrome.exe Token: SeSecurityPrivilege 2512 msiexec.exe Token: SeShutdownPrivilege 1260 chrome.exe Token: SeCreatePagefilePrivilege 1260 chrome.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1260 chrome.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4996 2604 XWorm V6.0.exe 77 PID 2604 wrote to memory of 4996 2604 XWorm V6.0.exe 77 PID 2604 wrote to memory of 4456 2604 XWorm V6.0.exe 78 PID 2604 wrote to memory of 4456 2604 XWorm V6.0.exe 78 PID 2604 wrote to memory of 4352 2604 XWorm V6.0.exe 79 PID 2604 wrote to memory of 4352 2604 XWorm V6.0.exe 79 PID 2604 wrote to memory of 2480 2604 XWorm V6.0.exe 80 PID 2604 wrote to memory of 2480 2604 XWorm V6.0.exe 80 PID 2604 wrote to memory of 2456 2604 XWorm V6.0.exe 81 PID 2604 wrote to memory of 2456 2604 XWorm V6.0.exe 81 PID 4352 wrote to memory of 1224 4352 msedge.exe 83 PID 4352 wrote to memory of 1224 4352 msedge.exe 83 PID 4456 wrote to memory of 1896 4456 OneDrive.exe 84 PID 4456 wrote to memory of 1896 4456 OneDrive.exe 84 PID 4352 wrote to memory of 2344 4352 msedge.exe 87 PID 4352 wrote to memory of 2344 4352 msedge.exe 87 PID 4456 wrote to memory of 2876 4456 OneDrive.exe 88 PID 4456 wrote to memory of 2876 4456 OneDrive.exe 88 PID 4456 wrote to memory of 1604 4456 OneDrive.exe 91 PID 4456 wrote to memory of 1604 4456 OneDrive.exe 91 PID 4352 wrote to memory of 2028 4352 msedge.exe 92 PID 4352 wrote to memory of 2028 4352 msedge.exe 92 PID 4996 wrote to memory of 5032 4996 Chrome Update.exe 95 PID 4996 wrote to memory of 5032 4996 Chrome Update.exe 95 PID 4352 wrote to memory of 3140 4352 msedge.exe 97 PID 4352 wrote to memory of 3140 4352 msedge.exe 97 PID 4456 wrote to memory of 2552 4456 OneDrive.exe 98 PID 4456 wrote to memory of 2552 4456 OneDrive.exe 98 PID 2456 wrote to memory of 3356 2456 update.dotnet.exe 101 PID 2456 wrote to memory of 3356 2456 update.dotnet.exe 101 PID 4456 wrote to memory of 3156 4456 OneDrive.exe 102 PID 4456 wrote to memory of 3156 4456 OneDrive.exe 102 PID 4352 wrote to memory of 3020 4352 msedge.exe 104 PID 4352 wrote to memory of 3020 4352 msedge.exe 104 PID 2456 wrote to memory of 2476 2456 update.dotnet.exe 111 PID 2456 wrote to memory of 2476 2456 update.dotnet.exe 111 PID 2456 wrote to memory of 1260 2456 update.dotnet.exe 114 PID 2456 wrote to memory of 1260 2456 update.dotnet.exe 114 PID 1260 wrote to memory of 3144 1260 chrome.exe 115 PID 1260 wrote to memory of 3144 1260 chrome.exe 115 PID 2456 wrote to memory of 3592 2456 update.dotnet.exe 116 PID 2456 wrote to memory of 3592 2456 update.dotnet.exe 116 PID 3592 wrote to memory of 4112 3592 cmd.exe 118 PID 3592 wrote to memory of 4112 3592 cmd.exe 118 PID 3592 wrote to memory of 4800 3592 cmd.exe 119 PID 3592 wrote to memory of 4800 3592 cmd.exe 119 PID 3592 wrote to memory of 4684 3592 cmd.exe 120 PID 3592 wrote to memory of 4684 3592 cmd.exe 120 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 PID 1260 wrote to memory of 4404 1260 chrome.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 update.dotnet.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 update.dotnet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5032
-
-
-
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3156
-
-
-
C:\Users\Admin\AppData\Local\Temp\msedge.exe"C:\Users\Admin\AppData\Local\Temp\msedge.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"2⤵
- Executes dropped EXE
PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2456 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging3⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8372ccc40,0x7ff8372ccc4c,0x7ff8372ccc584⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-logging --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --disable-logging --field-trial-handle=1796,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1792 /prefetch:24⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=1852,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:34⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=2084,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:84⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2900,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2972 /prefetch:14⤵
- Uses browser remote debugging
PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2908,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2996 /prefetch:14⤵
- Uses browser remote debugging
PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4308 /prefetch:14⤵
- Uses browser remote debugging
PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4588,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:84⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4680,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:84⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4688,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:84⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4956,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:84⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4700,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:84⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=5220,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:84⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5176,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:24⤵
- Uses browser remote debugging
PID:3528
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:4112
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4800
-
-
C:\Windows\system32\findstr.exefindstr All4⤵PID:4684
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵PID:4924
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:5092
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2016
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging3⤵
- Uses browser remote debugging
PID:1104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff836fc3cb8,0x7ff836fc3cc8,0x7ff836fc3cd84⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --disable-logging --headless=new --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --disable-logging --mojo-platform-channel-handle=1444 /prefetch:24⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --disable-logging --mojo-platform-channel-handle=1560 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-logging --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --disable-gpu-compositing --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1980 /prefetch:14⤵
- Uses browser remote debugging
PID:8
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
PID:2496
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
PID:4480
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9e7e54d2-20f4-4079-a872-0b2c40b27650.bat"3⤵PID:4900
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:3080
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24564⤵
- Kills process with taskkill
PID:2404
-
-
C:\Windows\system32\timeout.exetimeout /T 2 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:1360
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4544
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4820
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4776
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:4232 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1212
-
-
C:\ProgramData\OneDrive.exeC:\ProgramData\OneDrive.exe1⤵
- Executes dropped EXE
PID:1580
-
C:\Users\Admin\AppData\Local\msedge.exeC:\Users\Admin\AppData\Local\msedge.exe1⤵
- Drops startup file
- Executes dropped EXE
PID:3324 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
PID:2184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
PID:4568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
PID:72
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
PID:1536
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3924
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5364004b96450b2e0e8af314c416efc2c
SHA13f69a4512acb9f69f3d8420cf92dd13e39903f7b
SHA256e934fa0106d3b10512dbc0a1626b4dd5f34036b77512fa2a8eb3432b8e09012b
SHA512b878b81de88f40af89d16d8c6b350e0691a1f93ed99cb41300c9b273c4d9604b949ac04fd84f6e6011073313283f84d990ae901eb6faac637ae65d11ad890955
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD58694eaa77a5b3f1984349acc496ab43e
SHA131b20a025ea7e019959c351d4636af1c1f54e801
SHA256cccec2467e6b8f42624c2bdea449448dc4c07ccf506b0b3349c342c6f7665310
SHA51208ef9e6775ddf401505cf7fcb0691b7ec87efd66aafa1c6c8c98a2d091cfb5872fb6fbef457f7c080ba3e641fd9c8bc5c306ccebf2542859ad5401ffe53c1a73
-
Filesize
944B
MD580707036df540b6657f9d443b449e3c3
SHA1b3e7d5d97274942164bf93c8c4b8a9b68713f46f
SHA2566651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0
SHA51265e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f
-
Filesize
944B
MD54093e5ab3812960039eba1a814c2ffb0
SHA1b5e4a98a80be72fccd3cc910e93113d2febef298
SHA256c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c
SHA512f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b
-
Filesize
944B
MD5c24caab1947646fcc49d6158d78a56f5
SHA1aa2cd00401eb273991f2d6fdc739d473ff6e8319
SHA2560696315ad3df3edd5426276c265bd13d8bd2a0d101548bcaedd82e2aebde655a
SHA51235e1d214dfb4c7f078496e3e303aea152aa48f9db5b9aa188aeb82b541582ed77f60bfe8712836232b5aa31d3645edfc79b42c8f90e92e06778f21aa44971bff
-
Filesize
944B
MD569416944dac24129d0969e2ac46f0533
SHA1d71969659956b32411e0606a9bee640a0b108ef4
SHA256dffc7e01106427982d7cafd3d7e3be37e16b098fbb0958410ea8d7c68bfb97ca
SHA512aabb330053579af0d9de2661bd70eaadfd2e2e617759bc9c380db1c64731c6711304e49882138e9d337815377ee012a7458f91f692cb31538d73624385867f4c
-
Filesize
944B
MD50b59f3fa12628f63b5713c4833570d7f
SHA1badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb
SHA2562332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d
SHA51201724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7
-
Filesize
944B
MD52700ec89fc3e1dfe572f0680c27c0140
SHA1f79c58bb3dc78d63d6c8879e436e84d82ad9d066
SHA256bd25b0ad5116bf30b9dca67a34ec42e5668ab2288317625c56db9c1fcaef1891
SHA5121bfcc2fcba39bdaf1588a60c71cf450e07b8f70b983218028ae3ba6f31179f4c2578b806510b51d49ea354977bb8483d43889083e3c049c9093f695d541507a5
-
Filesize
152B
MD5f7e8333c0ce8232735b7ce62705e8459
SHA15b4aae82cecf0af1aa26f5d9a9fdcdad5b84f829
SHA25655fd0e186f7ddf2417eeab4646092bdaf09b7a1a66183b0e9db61542338d1a7c
SHA512b827ecd19d52b36f1b46406b30f7c6733b1e84ab2c421eb32e9961d864f32a72f7c5887f8ac2da4e44a12a5de6bd4970080a67ea9fae5eb4b107c928631aa2a0
-
Filesize
153KB
MD58b8585c779df2f6df99f749d3b07f146
SHA1b553267f8e6f2bb6531ca2cb330e0d6b7bc41a1d
SHA2564a9d13e9b68d26c6feb71856b7a61a2a1b8f2dc1c7aaa9ad5dfd5609b5a2da6c
SHA512b89cae4386d0b8173b87533b5af3d863a188836185d105d6007786ba0e415537e84b759b8c22b37430ee544c554db9f50aa21466c5549c8b80c4f5a3fa6cb5c7
-
Filesize
140KB
MD5a1cd6f4a3a37ed83515aa4752f98eb1d
SHA17f787c8d72787d8d130b4788b006b799167d1802
SHA2565cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65
SHA5129489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355
-
Filesize
14.9MB
MD556ccb739926a725e78a7acf9af52c4bb
SHA15b01b90137871c3c8f0d04f510c4d56b23932cbc
SHA25690f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
SHA5122fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
166KB
MD5aee20d80f94ae0885bb2cabadb78efc9
SHA11e82eba032fcb0b89e1fdf937a79133a5057d0a1
SHA256498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d
SHA5123a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42
-
Filesize
150KB
MD514937b985303ecce4196154a24fc369a
SHA1ecfe89e11a8d08ce0c8745ff5735d5edad683730
SHA25671006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
SHA5121d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
6.1MB
MD5b3899dd5602b3587ee487ba34d7cfd47
SHA1ace70e4fcea9b819eaf5bda4453866698252357f
SHA25628c53ad86d705da7e21a1c0cbc996e15ab8f024368aa031b025d05f3dfdbeb2e
SHA512104b8252db4e9a88e388370a6def71e0cbb536604d5a41ac60169a35a9662980d1359000d5ea316f29deb4c534678e86e266bba12bb0b658f2666d13b26c200a
-
Filesize
6KB
MD5b89abafc473a70a8dd78519dc600b9c5
SHA18a053aa1d7e1c19a5884c644e8361b97e35505c6
SHA256dad304197953ccaaa0a61199755fcee58b205cb3ee1ac1215e07c9404e872211
SHA512e6ddbedef6ba906c1fc608c51983ac728570b271a91b8f00718877e6913da4c5fb1c85a473ff7b241c1caa63052b58b7eab7f21b6ceb3a2609d624ee76c588c8
-
C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt
Filesize327B
MD510651b85ce8387d1ff0f2ead7ba07ced
SHA190f3dfb6cbb78a84e64621490c54f0b4cba69f1a
SHA25614170817d491e39fb55fc225eb2d0f3ab86b1741578cccb0478e2605df89d629
SHA512aa7573bb5bd86bbd027f1e60030e61250cb29b95802cb4732f9986c96b2b8a2b232e9957b04a667b6524ad0469f0713c3d2c481ed49d42f06f27b0efbffebab3
-
C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt
Filesize2KB
MD508ce1b9437c9b42839c4a954e7870f69
SHA1c8d5d692c2832f7fb201057d62405f7f3c10074b
SHA256b10e4b97dcff729a430b5c2db336c8586c28ce065d90552a8f081083d95edea2
SHA5120fb5587f3335d606e869e795037c46767e27a64ef4b5a8357f6b5c3f123494bac94b52ad4dbd97a24e469af60e8b81fd83749085d796d3c59f41bdb31f3d036e
-
C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt
Filesize3KB
MD5d10c0d7e773c68d41b20600ca4af647f
SHA19eba7ee8b5c4176e0343cb84d569da1393a1fa86
SHA2565ceb2497a6e3d7abad40171887bf40d7208626cf10d1aa7fb89bdc20918442cd
SHA51253856a13e8c6db8a1b7c1a5bfe67f35adda8d8b2f19f66396200b2fd2eb8129f31a4a35b6441e7b8fbd91d50a1fe86b6766c3b0f1f73c85936a3fb3f93277878
-
C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt
Filesize3KB
MD5a7e1766e129fe3f31613d6f8c2fa034a
SHA145b6244412dacbc0e4265989dfb0d84fcf5fb9f8
SHA256f13af5caa4a03a32affdb6402f22f660d0e02fb87ec6feb23e0526a389c7360b
SHA512fcc8373e38a88bf3df212bc14c6ebcfbc78002518f5e2db995e60bd6ce4e4e421bb43097a35be7083de759b489ca6c9e00a59887057d7dcb913e7ef5f867f5ed
-
C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt
Filesize4KB
MD5b6cef5fa3efed86444327046fa02479b
SHA10646cc2cdf24f45675cfe84e5115013e7b89d0be
SHA2564dcb738f8c91c2f22eef7d99d2bcda880b486e41e21e4332168d217252a79207
SHA51253b9a8fa831c29e810108b8d2ae65fe0074030cacadf8c33e0b9582bde416827090150fbf95f6eebfec95cf3a9720e4c036835d29c3ea487dc426fa37210ba14
-
Filesize
3B
MD56855456e2fe46a9d49d3d3af4f57443d
SHA19c882d5c6a1aa240b2672dce0ffb03360abcaca5
SHA256eaa0689a095d4394a05fb51b84b0175a47f68221261377e4829444cbfcae23ca
SHA512ec2da5ac90ee2e805e74c45a60fe8b81b96c750b1f7c53e78271c33a89f789b2a9ed9708a99364c3f1027015994b6f71acdb5e1abd2029ad3cbd28d5a2e412c9
-
Filesize
677B
MD5b2031a911c1588c63d56540e06770d22
SHA15f1ae01dce2ec4d32ff6f239552a6652193011e3
SHA256a19adb62612ede1f2805d3fbfcc9c1a5b34b495745e2ba758333e42d2deaf166
SHA512886a7766305f1cca171bd702b98a282a62bacb3637e250d03f81a145eff89fcb57d58dd93244cc0ffcb8b749110b3712bc7e2d7a4ba2184f6d31e3706a154eeb
-
Filesize
771B
MD54d6d8f1dd4a3a1c9e732180711830b2b
SHA1344d0594968ae499218261c0a2cd45a55c4455fa
SHA2566001af312f1f128b14bca6c2a984805807925f7046c8ce56d24d5dc637fa4f57
SHA512e8d8984677ae26b15bdf52b81f4d45ef7c830598662b1b942c40d15894134cdb81ad6e7a8a4ed18173fe4cca6d009ec25ce486806c13dcae15697be85862031a
-
Filesize
961B
MD5d1cd2da3ca6b7c99082962d91c751016
SHA1841107f8ecc75e4d51014c6fcc2e06737ba68574
SHA2564daba78d59f2b0bd4f5c21dbfdcc2d87c1b8b5565d2fba2f46ccc7102f1a89c6
SHA5125598bd61579ce53052a29ae72a55b6cdccbff8b175840f9dc3051fbc26dd63af703ebfaed7ab4219129692a0f2c8a4fb6d037cd6b32e7cf2ac65926747fef709
-
Filesize
63KB
MD567ca41c73d556cc4cfc67fc5b425bbbd
SHA1ada7f812cd581c493630eca83bf38c0f8b32b186
SHA25623d2e491a8c7f2f7f344764e6879d9566c9a3e55a3788038e48b346c068dde5b
SHA5120dceb6468147cd2497adf31843389a78460ed5abe2c5a13488fc55a2d202ee6ce0271821d3cf12bc1f09a4d6b79a737ea3bccfc2bb87f89b3fff6410fa85ec02