Resubmissions
27/01/2025, 20:41
250127-zgfs3svqbp 1027/01/2025, 20:36
250127-zdvstsvkcy 1027/01/2025, 20:32
250127-zbph2avnfr 10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:36
General
-
Target
XClient.exe
-
Size
49KB
-
MD5
9cda258445b322eb90f65b32ba86d86c
-
SHA1
d86a39dcc80db9cef23fc389dbbb6951ed7f908c
-
SHA256
0aca70f4574b4f593ad118de1846cb744eed48473a8fd51759c37e508d44e50f
-
SHA512
f76c77b63b6e881cd6e9a436b5efe5e4a45a8e78126fcc6876ec6855ef2572ba7e9dec7200e32ddca78f232d451305f87729ee5989f3c8ed83cde53d132a1d9a
-
SSDEEP
768:DaT5ryS4lEW64POSn1iQK4kb2UULNwLdVvM6wEO1hEjdoHj:GNrH+EWR5rkbzeNivM6wEO1yaj
Malware Config
Extracted
xworm
sponef159-35748.portmap.host:35748
-
Install_directory
%AppData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot7508868671:AAG6XIOhz39IrQIUnjub1TKVOVZHfdjpsvM/sendMessage?chat_id=6094400048
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1224-62-0x000000001B990000-0x000000001B99E000-memory.dmp disable_win_def -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/1224-1-0x0000000000E80000-0x0000000000E92000-memory.dmp family_xworm behavioral1/files/0x000b000000023cbd-58.dat family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4248 powershell.exe 1924 powershell.exe 1604 powershell.exe 3324 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe -
Executes dropped EXE 3 IoCs
pid Process 4592 svchost.exe 224 svchost.exe 2044 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 1048 MsiExec.exe 1048 MsiExec.exe 1048 MsiExec.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" XClient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: XClient.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll msiexec.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5711.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI600B.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4760.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4C14.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Kills process with taskkill 1 IoCs
pid Process 4236 taskkill.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\PerMonitorSettings\ XClient.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\PerMonitorSettings\MSBDD_RHT12340_2A_07DE_FC_1234_1111_00000000_00010000_0^6E57C9F13ED851F87291CBEB2395B57E XClient.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\PerMonitorSettings\MSBDD_RHT12340_2A_07DE_FC_1234_1111_00000000_00010000_0^6E57C9F13ED851F87291CBEB2395B57E\DpiValue = "0" XClient.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\613F436E6BEB3BF46A217F01F2751656 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A203DC83D8E5BD778453BE6D1E5656AE msiexec.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656\SourceList msiexec.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1924 powershell.exe 1924 powershell.exe 1604 powershell.exe 1604 powershell.exe 3324 powershell.exe 3324 powershell.exe 4248 powershell.exe 4248 powershell.exe 4472 msiexec.exe 4472 msiexec.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1224 XClient.exe Token: SeDebugPrivilege 1924 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 3324 powershell.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 1224 XClient.exe Token: SeDebugPrivilege 4592 svchost.exe Token: SeDebugPrivilege 224 svchost.exe Token: SeShutdownPrivilege 1088 MsiExec.exe Token: SeIncreaseQuotaPrivilege 1088 MsiExec.exe Token: SeSecurityPrivilege 4472 msiexec.exe Token: SeCreateTokenPrivilege 1088 MsiExec.exe Token: SeAssignPrimaryTokenPrivilege 1088 MsiExec.exe Token: SeLockMemoryPrivilege 1088 MsiExec.exe Token: SeIncreaseQuotaPrivilege 1088 MsiExec.exe Token: SeMachineAccountPrivilege 1088 MsiExec.exe Token: SeTcbPrivilege 1088 MsiExec.exe Token: SeSecurityPrivilege 1088 MsiExec.exe Token: SeTakeOwnershipPrivilege 1088 MsiExec.exe Token: SeLoadDriverPrivilege 1088 MsiExec.exe Token: SeSystemProfilePrivilege 1088 MsiExec.exe Token: SeSystemtimePrivilege 1088 MsiExec.exe Token: SeProfSingleProcessPrivilege 1088 MsiExec.exe Token: SeIncBasePriorityPrivilege 1088 MsiExec.exe Token: SeCreatePagefilePrivilege 1088 MsiExec.exe Token: SeCreatePermanentPrivilege 1088 MsiExec.exe Token: SeBackupPrivilege 1088 MsiExec.exe Token: SeRestorePrivilege 1088 MsiExec.exe Token: SeShutdownPrivilege 1088 MsiExec.exe Token: SeDebugPrivilege 1088 MsiExec.exe Token: SeAuditPrivilege 1088 MsiExec.exe Token: SeSystemEnvironmentPrivilege 1088 MsiExec.exe Token: SeChangeNotifyPrivilege 1088 MsiExec.exe Token: SeRemoteShutdownPrivilege 1088 MsiExec.exe Token: SeUndockPrivilege 1088 MsiExec.exe Token: SeSyncAgentPrivilege 1088 MsiExec.exe Token: SeEnableDelegationPrivilege 1088 MsiExec.exe Token: SeManageVolumePrivilege 1088 MsiExec.exe Token: SeImpersonatePrivilege 1088 MsiExec.exe Token: SeCreateGlobalPrivilege 1088 MsiExec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1088 MsiExec.exe 1088 MsiExec.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe 1224 XClient.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1924 1224 XClient.exe 83 PID 1224 wrote to memory of 1924 1224 XClient.exe 83 PID 1224 wrote to memory of 1604 1224 XClient.exe 85 PID 1224 wrote to memory of 1604 1224 XClient.exe 85 PID 1224 wrote to memory of 3324 1224 XClient.exe 87 PID 1224 wrote to memory of 3324 1224 XClient.exe 87 PID 1224 wrote to memory of 4248 1224 XClient.exe 89 PID 1224 wrote to memory of 4248 1224 XClient.exe 89 PID 1224 wrote to memory of 4532 1224 XClient.exe 93 PID 1224 wrote to memory of 4532 1224 XClient.exe 93 PID 1224 wrote to memory of 2288 1224 XClient.exe 115 PID 1224 wrote to memory of 2288 1224 XClient.exe 115 PID 2288 wrote to memory of 772 2288 vbc.exe 117 PID 2288 wrote to memory of 772 2288 vbc.exe 117 PID 1224 wrote to memory of 1088 1224 XClient.exe 118 PID 1224 wrote to memory of 1088 1224 XClient.exe 118 PID 4472 wrote to memory of 1048 4472 msiexec.exe 123 PID 4472 wrote to memory of 1048 4472 msiexec.exe 123 PID 4472 wrote to memory of 1048 4472 msiexec.exe 123 PID 1224 wrote to memory of 1632 1224 XClient.exe 127 PID 1224 wrote to memory of 1632 1224 XClient.exe 127 PID 1224 wrote to memory of 4236 1224 XClient.exe 129 PID 1224 wrote to memory of 4236 1224 XClient.exe 129 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x2a43gks\x2a43gks.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE12.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc915BF5E68913451E8B99C3C2646776D.TMP"3⤵PID:772
-
-
-
C:\Windows\SYSTEM32\MsiExec.exeMsiExec.exe /X{E634F316-BEB6-4FB3-A612-F7102F576165}2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1088
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
PID:1632
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
PID:4236
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7B13B1A5558266C39C98AE201B3672BA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1048
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4cc 0x47c1⤵PID:5064
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
PID:2044
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5a6ff12cda533f54deaf889c3a7b8f37c
SHA149acd5dd55c746e06d27e89bf8a59102ec7d5f5a
SHA256812d866d383b7bf291e7e8ba0d51a9f8e313fe59e6ccf253a19a36c2ac0d6c9d
SHA512bfcdd1f8bd7401fa8f4f8e531ce5078dfaab40c09c8c58e0c844318841d67b3a369d002ebf37e10a17d57db5d7acc07a17c27b51f6c82cc825bf522e19addc76
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD5dd1d0b083fedf44b482a028fb70b96e8
SHA1dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA256cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
SHA51296bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
-
Filesize
944B
MD5a2c8179aaa149c0b9791b73ce44c04d1
SHA1703361b0d43ec7f669304e7c0ffbbfdeb1e484ff
SHA256c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a
SHA5122e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3
-
Filesize
1KB
MD58fb4301129fe0f1a3b35b5dd05c127a2
SHA1c986ca145bad18173ffc71d173b8ce6abf1fa635
SHA2562024a34abaaaa7fa9ab56755e43261a9e3c3bc63862b44e6f5f2155ef331efa0
SHA51240cc186e92fd695733214caaead985367e2434c24d43883ff150689f8119b71c3a5d25b6f01cc96b12271a9b51dca7bda6de45ce376844b7945e78f1f6240c21
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD593779ba521d39dc43180dd5b7f627a2f
SHA11b5b89b07d5e169cfbbd96c1207ae92575f60839
SHA256fe18c950997a788bcc4fd55118e2c01c1f92e8bca6d2129b0a173b379e2ed905
SHA512f0c0aa92cf8240f859a00302c1a37a324c4833bebc1cf5b22f49a5cad3fb34f47cd0a758f287d6c4ee692bb691fed3fdd84c9724a8618232362dc87c5ea21887
-
Filesize
386B
MD5156a4b3e570d9c7efc0f0094dbceb24e
SHA1ccd7e470b9114884d6e958ab4d8b4c451f493c66
SHA2567443a1bcd15924a389e5da2a0530b6703a35aed61e63cd1a1d7d0699d49a5a77
SHA51290123975819cc2fc3030f94cc8bfce587e8c7efcca8c7ac8a1e99c5f3211c0a50fe16994836fb46fcb3a68b2157259a59f7a5928c19bba2fc3cb4059ecc8efa2
-
Filesize
313B
MD5414cc7f540be2a73c503d00510396284
SHA1f061a0b6d84b176bb7ac8d34a721079a4ebf9155
SHA25627f93a324e97e74ec2c5f4ece3c14d85e8e8c5d259188bb0e13ead03ee8c6028
SHA51201d7c3176184a5776332a5c97ab19f4ce4b2bb87c64b752f500736a3a6e1f1121640b31c46eee8a091a84acf8518d66ea2e59d1728e62d1842171800204d7f98
-
Filesize
6KB
MD5f735867fd69436bf3e3d9050b63b40b3
SHA1a104ac2851e30a0b2f8bce493b86e04720c56b45
SHA256cd8dbd313e578535d66fb41dcba898be2dff17bfccaca495dca09f52bca13a46
SHA512eb6e7aed1001ba6b2a2906e4c8217ce7152a927f23d10ffc4e3fddc007f447fa956118b76473ed83033c0d64e6dd32b8a5e20ec22d088ebe9bf4286f2b1861a0
-
Filesize
49KB
MD59cda258445b322eb90f65b32ba86d86c
SHA1d86a39dcc80db9cef23fc389dbbb6951ed7f908c
SHA2560aca70f4574b4f593ad118de1846cb744eed48473a8fd51759c37e508d44e50f
SHA512f76c77b63b6e881cd6e9a436b5efe5e4a45a8e78126fcc6876ec6855ef2572ba7e9dec7200e32ddca78f232d451305f87729ee5989f3c8ed83cde53d132a1d9a
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
133KB
MD54c243138e444ab4e21413acd69c6b6b5
SHA163204dfe68cf108a86c4cab22e2f890c939a5f76
SHA2566438a95c3566eee0577548bdc828180616f21efd2e9143fb316e11d2a16ef7e5
SHA512b285069fd0e1a48f4f2b447247ae184cbfec872182e7e31f88449158008dad13a62971f76515b3b5e9e6c600aa80d7694e2cba03f367396106ccbbb2c4ec5fe9