xworm | bf200fd4fc3cb983bd36958cbb6d0cdd23a25b5e8e897c2d8f7ac9758e728ed2

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-01-2025 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

65KB
MD5

f4e5f696d570d7941c3501411c0d1d6c
SHA1

4a22f1fc9571cf7da21df2eeb3db4d9af5ba5bee
SHA256

bf200fd4fc3cb983bd36958cbb6d0cdd23a25b5e8e897c2d8f7ac9758e728ed2
SHA512

9f21975b2eb8bc01d3fd7c18db02cf67cb1092013deac99842fb7868a213f23fcbc1cd37527b357be1447c332ed2b29dfc3e19925a5f654a6a1771a1ee9290e4
SSDEEP

1536:/o4f+hIhZduTpNj/PjkbFFUprp5QaN6GOIrma1:DxhqvkbFufpOIyk

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

sponef159-35748.portmap.host:7809

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7508868671:AAG6XIOhz39IrQIUnjub1TKVOVZHfdjpsvM/sendMessage?chat_id=6094400048

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4744-1-0x00000000000A0000-0x00000000000B6000-memory.dmp	family_xworm
behavioral2/files/0x002000000002aa6d-55.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3872	powershell.exe
2804	powershell.exe
4140	powershell.exe
536	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
4852	svchost.exe
1936	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	XClient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
812	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2084	WINWORD.EXE
2084	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4140	powershell.exe
4140	powershell.exe
536	powershell.exe
536	powershell.exe
3872	powershell.exe
3872	powershell.exe
2804	powershell.exe
2804	powershell.exe
3696	msedge.exe
3696	msedge.exe
2812	msedge.exe
2812	msedge.exe
3916	msedge.exe
3916	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	XClient.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	4744	XClient.exe
Token: SeDebugPrivilege	4852	svchost.exe
Token: SeDebugPrivilege	1936	svchost.exe
Token: 33	4388	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4388	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE
2084	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4140	4744	XClient.exe	77
PID 4744 wrote to memory of 4140	4744	XClient.exe	77
PID 4744 wrote to memory of 536	4744	XClient.exe	79
PID 4744 wrote to memory of 536	4744	XClient.exe	79
PID 4744 wrote to memory of 3872	4744	XClient.exe	81
PID 4744 wrote to memory of 3872	4744	XClient.exe	81
PID 4744 wrote to memory of 2804	4744	XClient.exe	83
PID 4744 wrote to memory of 2804	4744	XClient.exe	83
PID 4744 wrote to memory of 812	4744	XClient.exe	85
PID 4744 wrote to memory of 812	4744	XClient.exe	85
PID 3696 wrote to memory of 4588	3696	msedge.exe	97
PID 3696 wrote to memory of 4588	3696	msedge.exe	97
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 4964	3696	msedge.exe	98
PID 3696 wrote to memory of 2812	3696	msedge.exe	99
PID 3696 wrote to memory of 2812	3696	msedge.exe	99
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100
PID 3696 wrote to memory of 5060	3696	msedge.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:812

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SendSubmit.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe93043cb8,0x7ffe93043cc8,0x7ffe93043cd8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1904,13458348181517296162,4761512195244947243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
25e1cfeb52c955b2cb5aecd7c5d01bfc

SHA1
0764785cc3fec99763543d5c09187da81124afa4

SHA256
43c469fb147571f3dbaf527a216fe8a8255d865f5126815b2a4535e7a4b0f3cd

SHA512
bda11c795789e09bd8dcff919961145a0ebd60914b186a1ef31726005b628c7598e8b2c9f6f27b38d3dfb4f2ec89760dbcff799796b0026c3cc25981fb2bda50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dff073b85089515580da8888b3908823

SHA1
939d0fc585667d6371c91e3af1e18ffc3f9cceed

SHA256
4ae7d7642b7ffb08c4c48cc125819bf31898f251f68d44fd07cc6f2515ef916c

SHA512
0acbbd581abf9f5709f2819b9ed52d083e9dc88f98c2ad3b35894459f116e9bfbf94d8a42cb7c8847dda422f222273f2deb4c7fa293fa6332395a41cc56c50c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e217eb64795971a50ea26d630b40ab08

SHA1
a3a2d19481e024ab63122cbba16d11985d72806d

SHA256
eadda15089e8060c5acdade2ee476a2b784d7aeab31fae0e07dd53c0cbfce3d6

SHA512
85f34f835a2d96c81c1b7a87edd4eea6c832ec78d4768084d2742c5a819174b8540d2a3d200736c33186b14f7662bb80d181d0179061cab1b9a2eaf65f454efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61833fa39a26cfab559a0a7e020db799

SHA1
52d16f0575eacb0f08cfe9a2b94985c82358b46b

SHA256
fc190c572d0361e020496e880218a11e48e28f6886ddb564e885c2b588bafddd

SHA512
b0526044942d936f67ddcabfd96d3c41c24b74adf57c2be9b3ca11b16a18b49a7474254a40437268185f975ac9b75715dfac918b859b4a4bf48bcf41bf358b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61d9616a74f9ea1c12c67554c1d6cc33

SHA1
0ec65b92dd9e3785b40c76a9fddd4c9d258af130

SHA256
809a9e1f03c942a4559989ed8e4f454f0d5ce63270e3ed0aeaad25a8c40865b3

SHA512
d7126b707909570d7840b3e6583e8a4fe60ae247609a5e900cd0e24d3506c8d4c2c68b5928c2a16d5461e7a6caed6088886811f56ab5c1ca1e536da912c642da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\87b1202c-ccad-41b6-bc15-4fa7fc12debc\index-dir\the-real-index

Filesize
192B

MD5
bf0d9c95b9bc2fcfdf371f57a14e66b7

SHA1
5d7a3e007d99a68212656077fa52e3896c2efde8

SHA256
1da6589ec7534eee4090b32ad2d4a4f3fa76987603359c23fbfbd7880387f478

SHA512
703c9d02432613bc5710ba72c617841f8cbb14f333676c908bc54c58d87947e728153fd6e6bce2b2ab17c516dd78d6ee9380ca5f100f12c80c929581297ed80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\87b1202c-ccad-41b6-bc15-4fa7fc12debc\index-dir\the-real-index~RFe59a85c.TMP

Filesize
48B

MD5
d1532c9fdbec443598b0af9323e4eacf

SHA1
4bbeb2566272bd4a682d8fe0baf0e757b4113011

SHA256
0a69d27fa997527ec6ebb5c8c59822ba74e2f7b4faffe3f18c150dd2dae14e85

SHA512
9f054db1eb715f3faa52a22690438d1eb9b7e95e9c6884ab68d89f49ceaaab54d2210487927b8b0794160be4782b213e96bdcc768aa5f3c23c317fec86b79f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
6559549a57ed3f9def158b53b94b6bfd

SHA1
e8006c6ad9b78fc291280b6aee1b27ea27c235ee

SHA256
198becd2d1e6ef0250de53dbcce08f5862c337365eb5302117128a594eadc786

SHA512
0d6f8cde6e4ce2957707244907ac5f294864dad103085fb0d77b51bca7ae48fe300904b44853939e98eceaadc051e99695374a9b7c05b6be3a3530b0d663f589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
32ed4e594191af7efd92baaafb75ff90

SHA1
90aacffaa2de75079145c0c6c5e8b9fec153090e

SHA256
23925f53db18a93aa4ede33167f6d1b75823e840a5f9fbddd2f69dbdb8c3ecc8

SHA512
a25e5b725e5bd1a0f5004f6a9ac6f6f3698b573c9d021bc59315407b2442e34b33ffdd89ed8b8ca113ec176d96305f084c14ba6019e5ab1e0ffe7999769b26c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
83B

MD5
3edb17ab432d411a6c8ead0638de347e

SHA1
bd13fa235b25e357e7d24bb49ded91dfb74650d7

SHA256
56ff1c8f1809d2d81fa068ee29c1e10b7748f4d710c48f1e9a8da4b1c58c9072

SHA512
958442123ced592680e165cc0a065e25aefeeb3c696143253d5d1380b2a9334af532ba9f0bc6e4845f07b24a827c0129d2198006af35cd9d17ee5762d03bdccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
b9e1e419b03b3d4b5652148914acdbad

SHA1
7d37b7abcb66f11d66716bdb4470e625d61e69c5

SHA256
55d7367e65896dee22feb3412a2669652b28e60d325d6453320609620fabd2f8

SHA512
e6e31fd4411441a08df37a5458a39edb1dac64cf83dd216ca9a42d6c4ba8ded8060097c30d0f4615dfb67a13fd42eae4ad152f401728651b8e4166382992614f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c8bdaca52da74dae6455861e13ae23f1

SHA1
8eea7aeca95b2d89416239fc608100da36973440

SHA256
50ea7ce567202d131f1f1e8d50361598ecbfa6433f27796c0cd6fc9ee90e6bb0

SHA512
dd45ad5681e4c10d31f85341581cebfbb59a805681eecc83361f21b8ca4185eedb7817a028a3927be20d121a91e7526c8092dca8f0236acfc8d08a1d2f540445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a82d.TMP

Filesize
48B

MD5
1586c4d46307127018c60c5755f092dd

SHA1
acf8c4f916c9e66be531320ed961510b30f95575

SHA256
51444aa9b418b3827d9aae82f27f00e0be72f43a2babc59306ae5220ad127fac

SHA512
d57409257bbf1e73ac7a3531df86ae8bd558cebed474ca826d6e49eb6149a0e7ad7e52617bc06b71ad69e41f78950cf2c0753c1172fe95805226e3454ade5211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54d9fc180c71e555ebd6389dc664ed3c

SHA1
08b4e76b9fd9c19bf4fc60184717e9d51e707e34

SHA256
38137a4aec128414e1e1830389f301bd8ca69a47afe0325584fddd5210fab5cc

SHA512
2258f1fae0350419e976bf8a4e51cd6c1870bf8f7945b7f0b026767cdde38778ffd57ec5fd9f4a1c7729f22a3dc2f12dc32995ca44e98f3ad81d4cc39496e483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9eb03510fd7c405df86c45cb5a138a55

SHA1
c4979d824c37fbe679a42f890f632b0ca4035886

SHA256
b2a3d6021f4c447955f23475bbab6b860df4faff4df61d6925bcc814405550e1

SHA512
68a9a4d354663993a9e03b4e02fa00dbe2b4b0c97e94abd569cb9d5bdc65e514f68d7419026231c717a88ded15f236fe4d9b43866d441aee4c1b4446b4b5a74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
781da0576417bf414dc558e5a315e2be

SHA1
215451c1e370be595f1c389f587efeaa93108b4c

SHA256
41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

SHA512
24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
80b42fe4c6cf64624e6c31e5d7f2d3b3

SHA1
1f93e7dd83b86cb900810b7e3e43797868bf7d93

SHA256
ee20a5b38a6674366efda276dbbf0b43eb54efd282acfc1033042f6b53a80d4d

SHA512
83c1c744c15a8b427a1d3af677ec3bfd0353875a60fe886c41570981e17467ebbb59619b960ca8c5c3ab1430946b0633ea200b7e7d84ab6dca88b60c50055573

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vflt4xfj.xs2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
325B

MD5
557509cbe37689be7e31731388513e83

SHA1
a5bdec61167f7a34434119522e58461f726ba221

SHA256
0f55ed1ae7cfdb7e97092ab57c60d831372cbdd52b5755fcd62e6dbbc092278a

SHA512
f8bebac62db5724a85d0262697da85e33c5ff3d61b39b49cbed4b7132f09111c90624c4c1493e93a8c23c4c2a53167fb20ae212f7dcda1d6ddebf621ae019ec0

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
65KB

MD5
f4e5f696d570d7941c3501411c0d1d6c

SHA1
4a22f1fc9571cf7da21df2eeb3db4d9af5ba5bee

SHA256
bf200fd4fc3cb983bd36958cbb6d0cdd23a25b5e8e897c2d8f7ac9758e728ed2

SHA512
9f21975b2eb8bc01d3fd7c18db02cf67cb1092013deac99842fb7868a213f23fcbc1cd37527b357be1447c332ed2b29dfc3e19925a5f654a6a1771a1ee9290e4

Download Submit
memory/2084-63-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-60-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-115-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-116-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-65-0x00007FFE644D0000-0x00007FFE644E0000-memory.dmp

Filesize
64KB

Download
memory/2084-64-0x00007FFE644D0000-0x00007FFE644E0000-memory.dmp

Filesize
64KB

Download
memory/2084-114-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-113-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-62-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-61-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/2084-59-0x00007FFE67070000-0x00007FFE67080000-memory.dmp

Filesize
64KB

Download
memory/4140-13-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4140-8-0x000001F1E3140000-0x000001F1E3162000-memory.dmp

Filesize
136KB

Download
memory/4140-11-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4140-12-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4140-16-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4744-0-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

Filesize
8KB

Download
memory/4744-52-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4744-53-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

Filesize
8KB

Download
memory/4744-54-0x00007FFE85A70000-0x00007FFE86532000-memory.dmp

Filesize
10.8MB

Download
memory/4744-1-0x00000000000A0000-0x00000000000B6000-memory.dmp

Filesize
88KB

Download