xworm | aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper_2.18.exe
Size

79KB
MD5

810d912112f579781879ada392b70a53
SHA1

247bc212d2d44184bae484049765240ac9fa5c32
SHA256

aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939
SHA512

30fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e
SSDEEP

1536:N/SpZjwaZD0YqEnwqaDrMk+bXxNEPZSBVGGmMRZOf4miljMt8xwR2:CEYqEwjrv+bB8DMRZOf4m8M+a2

Score

10^/10

xworm defense_evasion discovery persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

daily-sexually.gl.at.ply.gg:25670

Attributes

Install_directory
%AppData%
install_file
Update.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/3016-10-0x00000000022B0000-0x00000000022BE000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3016-1-0x00000000000E0000-0x00000000000FA000-memory.dmp	family_xworm
behavioral1/files/0x000a000000023b9b-31.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Disables Task Manager via registry modification
defense_evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	bootstrapper_2.18.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	bootstrapper_2.18.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe"	bootstrapper_2.18.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	bootstrapper_2.18.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
3016	bootstrapper_2.18.exe
4548	msedge.exe
4548	msedge.exe
3304	msedge.exe
3304	msedge.exe
844	identity_helper.exe
844	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	bootstrapper_2.18.exe
Token: SeDebugPrivilege	3016	bootstrapper_2.18.exe
Token: SeDebugPrivilege	4816	taskmgr.exe
Token: SeSystemProfilePrivilege	4816	taskmgr.exe
Token: SeCreateGlobalPrivilege	4816	taskmgr.exe
Token: 33	4816	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4816	taskmgr.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
4816	taskmgr.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	bootstrapper_2.18.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3304	3016	bootstrapper_2.18.exe	112
PID 3016 wrote to memory of 3304	3016	bootstrapper_2.18.exe	112
PID 3304 wrote to memory of 2748	3304	msedge.exe	113
PID 3304 wrote to memory of 2748	3304	msedge.exe	113
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 2108	3304	msedge.exe	115
PID 3304 wrote to memory of 4548	3304	msedge.exe	116
PID 3304 wrote to memory of 4548	3304	msedge.exe	116
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117
PID 3304 wrote to memory of 2420	3304	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\bootstrapper_2.18.exe
"C:\Users\Admin\AppData\Local\Temp\bootstrapper_2.18.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaa9146f8,0x7fffaa914708,0x7fffaa914718
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9440610648595556238,4769729091051421765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:2712

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4816

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b69910d056ad07619565040659bc683c

SHA1
5333cb66279d8aa6bf01f4b217d051bac0c946fd

SHA256
de559b9a0690c388671e8e9a804e97ff13979a453532b889556a5c4f52498e71

SHA512
e33b982bc2ff17afd5d482cdc2556a64f58e76ee8abb4a62d03b08a271cf9c0b54e155e5adf7d2bdf5eb5a5732e5ce2ace38bebe5747d51e88b64ccd65712b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afd662223a36e3614118441c9d8a37b5

SHA1
c33b0265e85ae6126f6b2a5cba3e2f47a9b75999

SHA256
f3b7bb761fd573c6e36233227f75e9bf88d33fc47cab0362ce288744ceb69e05

SHA512
424952c5b6da2276b03f0456be67437ee40c103039697d3a05c046f809cc569f2e0fc736ecabeea64b3336c5bf96dc00145b62b593fa1115874dd3b45d0ffd73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a2ab1030cf30c232ae045e3dfaa11fb

SHA1
db5b47128b2815ce4ecf0394fc105944007375e8

SHA256
fc0cf02cd13c4b46daf855a2a941a2f2bab25a9ae6dc4908cea706c639a4e5c4

SHA512
3c32b7e46c037cc5b9b7ef4468d0d906ccfa7009f047ffaac3b8c42542fd785e9b3f0b98f4f01d2f1d9948afd704d2e70acde471c8fca070627b597b7785735d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Filesize
766B

MD5
e0b8fbf2bec96869ea590f38561f3ea2

SHA1
ecb7861e3aa5bd7e4faac57fba6ea3a4dda273aa

SHA256
a8ee6b24851ae0c370c5f6a20c880b6702407e5c91df00f7e2437fb89e093526

SHA512
07e6609ae62d4ab01abca90605a985cf5721e53210dfa9d6662c68db908161e297b10fbd52919c66fb74b321597d858510eb20ba88cace4ea09aa72b79febea3

Download Submit
C:\Users\Admin\AppData\Roaming\Update.exe

Filesize
79KB

MD5
810d912112f579781879ada392b70a53

SHA1
247bc212d2d44184bae484049765240ac9fa5c32

SHA256
aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939

SHA512
30fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
fc0852590a01f242bcde4b10aeb4d392

SHA1
d2f527f8c16706b0c065ed09d66a41c5e5a1dab9

SHA256
5b936daad6292b0a107ade3ba5d1502b12abf25a37f79a69d69113586428680b

SHA512
864694f9a8405412ab527c51379f9c060425f340c7bf34a1f8883c0ec4a79653fc2c1dca022d007767a98a1a9bd5e8c6f82177acb793aa5eb3eb31a9481de04b

Download Submit
memory/3016-8-0x00007FFFCC090000-0x00007FFFCC285000-memory.dmp

Filesize
2.0MB

Download
memory/3016-7-0x00007FFFCC090000-0x00007FFFCC285000-memory.dmp

Filesize
2.0MB

Download
memory/3016-6-0x00007FFFCC090000-0x00007FFFCC285000-memory.dmp

Filesize
2.0MB

Download
memory/3016-37-0x0000000000930000-0x000000000093C000-memory.dmp

Filesize
48KB

Download
memory/3016-1-0x00000000000E0000-0x00000000000FA000-memory.dmp

Filesize
104KB

Download
memory/3016-9-0x0000000002310000-0x000000000231C000-memory.dmp

Filesize
48KB

Download
memory/3016-0-0x00007FFFCC090000-0x00007FFFCC285000-memory.dmp

Filesize
2.0MB

Download
memory/3016-10-0x00000000022B0000-0x00000000022BE000-memory.dmp

Filesize
56KB

Download
memory/3016-36-0x00000000008B0000-0x00000000008BC000-memory.dmp

Filesize
48KB

Download
memory/4816-18-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-23-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-22-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-24-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-25-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-27-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-28-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-26-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-16-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download
memory/4816-17-0x000002264D970000-0x000002264D971000-memory.dmp

Filesize
4KB

Download