xworm | hxxps://mega[.]nz/folder/KdgzzZqb#zKMONssLUep5z1FsZig8kA

Analysis

max time kernel
627s
max time network
628s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/KdgzzZqb#zKMONssLUep5z1FsZig8kA

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:5050

our-vehicles.gl.at.ply.gg:28477:5050

Mutex

wnVd8GWvNyIxZDME

Attributes

Install_directory
%ProgramData%
install_file
realtek.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023df8-237.dat	family_xworm
behavioral1/memory/5208-239-0x0000000000710000-0x0000000000722000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
5208	injector.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
103	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2580	msedge.exe
2580	msedge.exe
2064	identity_helper.exe
2064	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	2180	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2180	AUDIODG.EXE
Token: SeRestorePrivilege	6116	7zG.exe
Token: 35	6116	7zG.exe
Token: SeSecurityPrivilege	6116	7zG.exe
Token: SeSecurityPrivilege	6116	7zG.exe
Token: SeDebugPrivilege	5208	injector.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
6116	7zG.exe
5628	notepad.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4428	2580	msedge.exe	86
PID 2580 wrote to memory of 4428	2580	msedge.exe	86
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 3032	2580	msedge.exe	87
PID 2580 wrote to memory of 2884	2580	msedge.exe	88
PID 2580 wrote to memory of 2884	2580	msedge.exe	88
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89
PID 2580 wrote to memory of 4604	2580	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/folder/KdgzzZqb#zKMONssLUep5z1FsZig8kA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88eba46f8,0x7ff88eba4708,0x7ff88eba4718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15344666814593505119,16945576311217230459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x320
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5880

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\aimwhore\" -spe -an -ai#7zMap28685:78:7zEvent5733
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6116

C:\Users\Admin\Downloads\aimwhore\injector.exe
"C:\Users\Admin\Downloads\aimwhore\injector.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4dc795d7-7c68-433a-b670-86e16b03473c.tmp

Filesize
11KB

MD5
7f801343fe6b7a607d39677790abc141

SHA1
7e6318a9a48c2eb9151f604427c640f1ad1850b9

SHA256
5b75b64cc0dd5a4069d99096708b454bfd835d1743532a271790fe8b7f3aab48

SHA512
9e17a6f9115489fa8fc4f45281e0ab8b9e112709423d16682b9ba04a89edc8d58703c4951ee16364db30d44c164d4033afa1a8c3e5dc2e1f8f8938902ac4f62d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
214KB

MD5
d20fef07db1e8a9290802e00d1d65064

SHA1
71befda9256ed5b8cd8889f0eeab41c50d66e64e

SHA256
f9cb4624d03224bfce50c4c0e484418acd462c249f38b4684e72b27a1f30144d

SHA512
ad5b2c8df60027c6dd5104bb8c2357b04eb24d69245c607ff99a6f2a887f929428252ad793d9aaa8c903c7b1e1bf9653cd35f79747d5281e7e3d2c21fa828537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b748e71f3602fb984ef23517961e01a4

SHA1
92a6e74708dd3ccf5314d21ba77027331f005bd2

SHA256
94ae5591639b567b63b3b7751c6fd73dbbb9a3f0ee37a165e0cee700661587dc

SHA512
34bba366ea0e93620b4aed5e52585edbd8fbdf19efd7607ecdf079683d7df4748eb8316e8b7efe3ba0926f0276492a6b0dce2ef2a5606207f97f009573140f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6b8429f7e138b58c8240a89e0a887755

SHA1
0c9908aaaab49597772b8c524e665e21ad71aac9

SHA256
51f3eeb3fa97ade6f7d7ede5e81699f65e896848f143779acf74c0551ffab9a5

SHA512
15d2faec7c6c0f6516a1d5fd0a2a781091ac277fa6fb9ed6920ef7cd14e8552f69ed37bed729e63f87bff9d42d3c41fa57f8f081fe3987a6b0aac443ed97ad7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
257B

MD5
cb2c370608ed5735aec0094cbed1ddbb

SHA1
8b9da953294d7078e9636c4a122d4c98651bfc17

SHA256
01fc00c66b187f3bcf3aa0ab676274ae4629fe537f3e0a50c9c1528e0849d5b6

SHA512
87fc267886df91e9602f890fc931ed971f6892106bcc67774c5869f124755389f6016945d099a9966c08a93a1c1110f5d93242efff93a55de02cde39854ac9cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
03d9a1494301a6ee8d2281e2ad453345

SHA1
1890fc44506090c4475c6591adbb5f1a4493dd9f

SHA256
2e41f1c28563ec4f070aec03ec53a63cbd91da1fbf51628f98578165a2162e86

SHA512
e6719fdde2f613fd153f2ab90f005d87ca7f551cb0c470aa6abaf84d304bf524ab9cb9b92d4e4225a8ab4b0d3efcf262a7e3ed436d740f673abba7e2074dd1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6392c536a8f9e4f4ce2dd8ee7a7fb2f9

SHA1
b753c2cd2a404f07a37a6131aad78229cfe6c4e7

SHA256
d52be827881edab425bf02ee4f95c389ec395f72b6e5e2281235b93d95da2229

SHA512
73de23c5965e3c560d669ef4af6c156b6bacce9324542739ba773eff1c1f49240fcd411f1ca95d63f491f0f37bc22e5eb806842205bebd2283ca098ada51da95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6047783942013bab9aa2c4c4bb257641

SHA1
60d65b88c4e1920cfe2c3918dfb9111f638969c5

SHA256
de6b64c0953b9cac139ab955235b93753ffa300bb4d40d91e9036eebebe74cff

SHA512
846d69bd89e7dcd14e70b05fbee99151721e333d4427b1b606e207950309d5cfde5d7bdf480c35c9a23ad17c6fa43d2dce22c9f6a0e1df5b4fedd6660362c717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
307392550d75d8e8fd0760c6027c3dce

SHA1
df659fd0580292647665f824d7be6d9f825b53f0

SHA256
6d141deed25fb0927ef6a3db4f6ffba620d0041a4325cacaf001219cb3633132

SHA512
9aeb0efd82a346b28e206deb2667c9bfa41c0661c363160bfd8a5693c852f70d6e680a8c5775b34bcdb9dced10e316b71a1301ceba03f1b2e9d84a47d83b1b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48169b024a7b0a0b47f15cb4d88c1665

SHA1
2d4de6d790a8cee91591bdf7a469f548491e0024

SHA256
991941c3def2ddd547ecaaf6a00a6fa39775fff483ad7f1357590dc451e04038

SHA512
ca8bc22ec8c4b1dfcabe7e0a3d6495b29ce1cd653f90ceb3d9ec191e4707f8b4b61d33f412d0e59a9ca9d3c62eac003695e546d8328397561317b430ae2ffe7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7e82898686c8480a35301466339092d6

SHA1
1c7e79ef1237a8a055226d0c0a69363db3bd40fb

SHA256
ec4cb122a3f22651d63b836d852ba90a378265ce06577096fab7405d1ca88361

SHA512
20f3ab03796be8580ab7465cfd75e309f96603ca68e5c3bf81f0631f3311f5feaf399aad9b61b5d4945dddeeec22026fec692ed36562cc88bdf4a7ab991d9c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac35c3549b0b640de1d5e51091be14fd

SHA1
1b5c5bfe298fb5acbbef020a119c7fdc5e95429c

SHA256
d9e960cc8c83fd46e91b75040d03dc7f688119143bf64cdc8e48931738ac554f

SHA512
5cf901b248d733a45ac656397b46b1e11fa57b4a53d8b7ab5287afbf50372a10d3834a006d20d88ecb066c1af4f7e8c998bba021f41f697a9453dd06d4d62612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
176cbc901a56f351b6c4b99b08919c6c

SHA1
00d1b5a987517a7d382acc9b736de6782697342e

SHA256
1948fbb1d50a7d63d81ae2c3a6054af5b4a0ed0ba11df2dd3b8754c10d465b9b

SHA512
8dba587b07dbd11733042f74b6378c25388e68e7c467849c330e53b93b832a6db89e6bef6aff9f480008bdd4d621ffea729b1d1d1d2bf64ee0a3ec7370789b08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
fdf6a8cb71bb6a6ca638914ca8b429ed

SHA1
84279901dd3264886f00e5377918bae6863ee563

SHA256
60583ce813fd150abff1672ce71d912c06099ef838798c08f387d15f3a15a1f0

SHA512
5eac02fe5ed0cf7c03ae35e2f147286e7dc7eba1560bb44f568fb8565935d20838495e7dbcb3ea031fea6baa389f626f4bbffe68cb17c29449c4f59df7029727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e49b19883180feaadec5a2f659e2a963

SHA1
02ba95383f410dd3ab63af838e8fc35b4e04cc4c

SHA256
22c7dc9e01c770ab02fc3659933ea8d4ee4ef57bbceec6a67a597f6504959114

SHA512
6b978736a097d20d76263e772242f0e4e74d0887f89e64bb323bc2a7c15bd4d8abceced19606ce97c22ca35710048b31edd38c9ba1c6cc55a2f3a8309ce2d707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f2bc.TMP

Filesize
48B

MD5
015b910965c8e07273302425f43d47a2

SHA1
aec31c17e74019fe7385a4d0378c845799d992e6

SHA256
426c7387a4d102f05f35d96d1cd5c9f7895518234d008b1d7e7b3914d14de8cc

SHA512
700c59f6ee793d8ea195b4cd15f16f6753b4de9b85a33d3dcb1d0f7363340c0f1267edd758dd58d40ed5a65a7d68828c26c1f526d093c82dbddc23e558712050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac14b46396b1fde0d4b5ae5c749acbe6

SHA1
933051a6af4cb8950ef7ad5bc8625cba997cd121

SHA256
cbd5f8eb0e7f16e1ede6ad07087a29f79e1ee4887fd27b65785eab1591fd54dc

SHA512
aca1f603044496b3c86aa873efcb319b5545c0548d167451be649e961776753ba99d14a11bf985adeeb737dd681744633a8319fb3e5aae34a17949513d4cb248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591081.TMP

Filesize
203B

MD5
0914a477a610c63c812c4c53f4728048

SHA1
6677405e983db2992a8a2e9fc2477ca8d40d1e25

SHA256
2792bab11bd808b9701ceb11693c33b9f8ab7edcf2bc867a687a8c08f18a3a61

SHA512
32e68dfa683eafbfdc33bbe5973f5e6f1ee21e1bd40ac931f9df237c7679bf5fae9b05a4d1f961a4b37da78273dd377ee00d6061e9b4964a2a9828d10dd2f925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
391db81171b3c02862b5f2fa1135929d

SHA1
ab5e2e02b36e98b5a32743138e01aa06b14666b9

SHA256
a3de32895932a5e8242b4f36273e314ade702af28003a02344a5e92fd05fad9a

SHA512
19fa4a21e4ccd1d4db4f22bc390cb7594e4b349881bffb9753f7034654546f4b56af1ff8b58ab6275cd4c49639a342822ec5cfeb0380b0c31fc3b6ae58dbb589

Download Submit
C:\Users\Admin\Downloads\aimwhore.zip

Filesize
13.3MB

MD5
a8d3e213fdf8ef2416b21511d499c292

SHA1
b68cb4bca62c4d488a0f21139920ed43567d1a0e

SHA256
701a654fd5e10b1154002207fe2478494c2f8edd17cc70dc8e14517131c88c27

SHA512
d5f96e01f201b817e81651200a132eea911c25d97ff6bd55e2456ef91de027a5a5cb533a07c614ce58fa34276b797e1a9e1132a5b7a3ae871e64341793489a82

Download Submit
C:\Users\Admin\Downloads\aimwhore\aimwhore.dll

Filesize
13.3MB

MD5
06dc12502d74010857b0bac23e5fb6e5

SHA1
d01939abc1c7da2da19123c9cb84724649d32bc5

SHA256
f2a4966f2043d71aeae53717c2e338b1508590db8e72c55e3100bbc100487f0a

SHA512
b49f6fdc90b236a00510045049cd2d9a254455116df399edea34ddedd89d72449f895eeadc941c26f8411b7c6bf124e15f4207126bac6da702b23a6a33b24191

Download Submit
C:\Users\Admin\Downloads\aimwhore\injector.exe

Filesize
50KB

MD5
a651fdc5aa4f81ba6b65d8da40ee4faf

SHA1
08050be8ee945d0799ec5cf619862f28e72ee452

SHA256
1d94d745b7d70df1d639df65a419f66097701d5dc987c46daf89284129544071

SHA512
10af426bafd14ecc0d56099a3e59b565619624d8495b66b86291313f73d8d8e7995711c698eb7e5e6d53b747bdeab44ec01eca35f6b90cf19d9f3a010ca56cef

Download Submit
memory/5208-240-0x000000001B1E0000-0x000000001B215000-memory.dmp

Filesize
212KB

Download
memory/5208-241-0x000000001B220000-0x000000001B236000-memory.dmp

Filesize
88KB

Download
memory/5208-239-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download