xworm | hxxps://docs[.]google[.]com/uc?export=download&id=1ppq1srLUQDyFV5XTi1Lz4FPvCkBZQ-Zb

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=1ppq1srLUQDyFV5XTi1Lz4FPvCkBZQ-Zb

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

213.209.143.123:1458

Mutex

EZZZ5HgfKx6ZqBg1

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/5660-121-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
5908	41951985625198152.6529581252.exe
5340	41951985625198152.6529581252.exe
5076	41951985625198152.6529581252.exe

Loads dropped DLL 3 IoCs

pid	Process
5908	41951985625198152.6529581252.exe
5340	41951985625198152.6529581252.exe
5076	41951985625198152.6529581252.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41951985625198152.6529581252 = "cmd.exe /C \"start \"\" /D \"C:\\Users\\Admin\\SystemRootDoc\" \"C:\\Users\\Admin\\SystemRootDoc\\41951985625198152.6529581252.exe\"\""	41951985625198152.6529581252.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41951985625198152.6529581252 = "cmd.exe /C \"start \"\" /D \"C:\\Users\\Admin\\SystemRootDoc\" \"C:\\Users\\Admin\\SystemRootDoc\\41951985625198152.6529581252.exe\"\""	41951985625198152.6529581252.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41951985625198152.6529581252 = "cmd.exe /C \"start \"\" /D \"C:\\Users\\Admin\\SystemRootDoc\" \"C:\\Users\\Admin\\SystemRootDoc\\41951985625198152.6529581252.exe\"\""	41951985625198152.6529581252.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5908 set thread context of 5660	5908	41951985625198152.6529581252.exe	134
PID 5340 set thread context of 5404	5340	41951985625198152.6529581252.exe	137
PID 5076 set thread context of 5524	5076	41951985625198152.6529581252.exe	140

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6064	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
2592	msedge.exe
2592	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
5160	msedge.exe
5160	msedge.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
5660	installutil.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	5576	7zG.exe
Token: 35	5576	7zG.exe
Token: SeSecurityPrivilege	5576	7zG.exe
Token: SeSecurityPrivilege	5576	7zG.exe
Token: SeDebugPrivilege	5908	41951985625198152.6529581252.exe
Token: SeDebugPrivilege	5660	installutil.exe
Token: SeDebugPrivilege	5340	41951985625198152.6529581252.exe
Token: SeDebugPrivilege	5076	41951985625198152.6529581252.exe
Token: SeDebugPrivilege	5404	AddInProcess32.exe
Token: SeDebugPrivilege	5524	installutil.exe
Token: SeDebugPrivilege	4240	taskmgr.exe
Token: SeSystemProfilePrivilege	4240	taskmgr.exe
Token: SeCreateGlobalPrivilege	4240	taskmgr.exe
Token: 33	4240	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4240	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
5576	7zG.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe
4240	taskmgr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5660	installutil.exe
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE
6064	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3520	2592	msedge.exe	86
PID 2592 wrote to memory of 3520	2592	msedge.exe	86
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 2544	2592	msedge.exe	87
PID 2592 wrote to memory of 4172	2592	msedge.exe	88
PID 2592 wrote to memory of 4172	2592	msedge.exe	88
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89
PID 2592 wrote to memory of 1408	2592	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://docs.google.com/uc?export=download&id=1ppq1srLUQDyFV5XTi1Lz4FPvCkBZQ-Zb
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb51ab46f8,0x7ffb51ab4708,0x7ffb51ab4718
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9966890743908737911,16753918092858611098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5392

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\41951985625198152.6529581252\" -spe -an -ai#7zMap1182:118:7zEvent20638
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5576

C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe
"C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:5712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5660

C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe
"C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5404

C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe
"C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4240

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SetStop.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6cdd2d2aae57f38e1f6033a490d08b79

SHA1
a54cb1af38c825e74602b18fb1280371c8865871

SHA256
56e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff

SHA512
6cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2b08db3d95297f259f5aabbc4c36579

SHA1
f5160d14e7046d541aee0c51c310b671e199f634

SHA256
a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869

SHA512
3256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
cebc3a69d7fcaf9deea7a006bb8b4b71

SHA1
a585fb820812cc5ed64ceb5c1c12282909c27cfb

SHA256
8f5d890185fb01b51775dea75a2497dea8833d1ef0d4f73523349fd381b0af9c

SHA512
5cd87aeb0dd18aafb567fab12948723d1471fe61d2c7c06c88ee09ec4c66f2dd80b539cac9c132f7c8cb5d41678c14e5a14192ac10e42b286c84032d39846907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4faa90568d92daa9eaa88976070487f

SHA1
696072c0e7d502a23c67839dac264263e81a853b

SHA256
0141b16421a7bdb511b8f8c5a91735f34623d82b8fe16db171f6686004f26d9b

SHA512
8c0e3ed0accaaf8371cbfef895ecd886cf1b76c58d73fc1074fff4b3ae615a7f3fe84ec74b0eda3a158280624978f27140fa24591c1e9b6c8dd8c214172cbcea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbde0329b0f7d9f4a7aab15600f6bb83

SHA1
62c428300a080ac38b79c97e10396449809a1914

SHA256
2bfd485b57a8e4801a12b948c7f402c14e4caf904c768a61429c4cbc5dc2e5c2

SHA512
a434e5364f48684e3430fcd18aaa6f1f4b44698a2c30b180bdc37613a6bafe3fb8dea1d0d0aa4b47b10d865971aff986b66be52dfeacfec1fd8ff4d43f00f411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a19207dddf467ffe21661f05237344d5

SHA1
0aa09e5639b35b1905f6c7106c84653f73502ab9

SHA256
962fca07e8aefc1c72843c656b86878ab0c5b9f6091de07bec9f9210206d01a7

SHA512
97907ba34a32e39c78ecebd795e84d2eefd1630d844e6c2abd69f323a0198b5806cb93a9081703f4521b5069e41dd6a1d4b088994747592cdd85b81b65b2c4a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
152e9c7f32d4ad1696a72498abe43508

SHA1
1b69a03e55bba8dbde99cd07f0d27c8fd9efbc71

SHA256
290f53deb5d9d6fa81ca5acced123ec3ded9d60a19ca4cf1683cf014421dc5d7

SHA512
f8ac94a956fdbb925349d194d114bcd172b7786c9b7dca815a01899674a7c6589396a71c9526c4c97fbf2f9bfb9cbf69c35c2c32b8364547116277d959f905ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed72a8c0433006b5dfdaf154d0eeecbe

SHA1
ff3337df26f32c4a96c1e423c64f4ccda471f571

SHA256
8d1a3ee134144724bda17a1c769660ae391607b50a164f4956a6af757d349b98

SHA512
65a5843c50173a0724f493ef9abd04781c3bd61efd1ac406561e0df110c55a36f60d81811c6f2eae77bc596c576263afc39ef999925b11c81e89a23bd2785d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6d3c918f9782ebadaab85fc1e22579f

SHA1
242cbaf13bd73ea823afaacb3201e5a35736996c

SHA256
8b54c35b14a528983ca142ddbc9a525ed8d76222af97c2f734e151695ea665e7

SHA512
f1fa21ef9e9bbbc3e134706dc9f32b56cfb37776ca8ea21336068feab462f27f98ef4889736f82c66bb876c406c6d7c0004818471a870e369a222e26064aaea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3b59b4a17ac61207636874ac2f88bebd

SHA1
de808d141543664c824617bf6e84314b7f185ffb

SHA256
600987a97ac8754d67e51518a4244f78434b8aeeb0b276717e47b33b4cfebfaf

SHA512
c3c5ea2e8695b8789062b219e5de25295b9a2a93f2d1077d84f2c7efb7d1ee4b099cc9b7a12c0381a49a99a64c4307ffa0a1728f59860b33f020b5405c100de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
a7f1d979881493abc2c341056faf93c9

SHA1
7f2f644be3a29ba0bce941112c1f3a4d924c8fa7

SHA256
76b2128646aa474e5e7c0f55d1636c90de1e2a8072d7961807129fd141f08846

SHA512
6540b6a75f274220bc46f1245edc1480d3149f61c2160d973ded02dcefede397d954af5d05a1ccaebd7da349d7415a893de28d61c61eb37c6cbcd470af0d97f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
254B

MD5
a9f2312ba65351e1ee9e6f94c5cb8de2

SHA1
8e1f79e9bd9c7d36e32562a41b8611ec7ec34a34

SHA256
2ce023d2354c6549f9ebc73a3817461cd9e68bc5d028a3db8dc05123b77a29bc

SHA512
27363d099d14082788e406e90a7932bc16ba3cd39f9773515d5b4274d283eb3993953913147d0e460e433a2d920d1c87bf5a10ce6bb6ed37f68809751d62252e

Download Submit
C:\Users\Admin\Downloads\41951985625198152.6529581252\41951985625198152.6529581252.exe

Filesize
1.8MB

MD5
b74e73be57c0aea5930a13944cc6deec

SHA1
cbb12b44cfa6d65cd28a520e993c7faca40bbe94

SHA256
76bc56eb8091f6923dba6304f5cec47fee92eacc8235c39d03e71accf8e0488f

SHA512
12fe82e32902d0a817ed393599a689533d5e6dbc49faf53669b1086101c7fcf7f1d8ad262e87b161d57481fbdf283035e8cbfc7c1bb669895445bff26e0a3aa8

Download Submit
C:\Users\Admin\Downloads\41951985625198152.6529581252\sharedk.dll

Filesize
3.1MB

MD5
5c84afc73458089cfc6a2e4184b83f91

SHA1
56222c7351028c1ac1d240651fc57c783e35391b

SHA256
cde971946b01d8f6d37d98a6146eabf2ed3d77a85ce00d21d6d68b774cf0ecfe

SHA512
067da99c10c015c77f3d54c5bd656ff2e7faaddc5ece2aad787efba0469e9445735fadfa7655f550fe804e053480d283eb638a98c31432d8e2aa3e277419644b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 229551.crdownload

Filesize
1.6MB

MD5
e1ac7471b8615f16105b965a2a64e506

SHA1
5d7574e6cb80de8c18bdfa1f331db7317744abbe

SHA256
49c8c73d3056c9cc892555e7efaad6cc4c40d43a471b0e07864a436bd4b753e8

SHA512
69cb11eb5c2395f54cc8181defc1e7e500bb95048e38dd777177743d48357653da0869e4313c11b526d4c25f104a7bfb92510ada44810cc158f656f5ed1951db

Download Submit
memory/4240-171-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-177-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-175-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-169-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-170-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-176-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-181-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-180-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-179-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/4240-178-0x0000025DADF60000-0x0000025DADF61000-memory.dmp

Filesize
4KB

Download
memory/5660-121-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5660-125-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/5660-149-0x0000000006220000-0x0000000006286000-memory.dmp

Filesize
408KB

Download
memory/5660-123-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/5660-122-0x0000000005090000-0x000000000512C000-memory.dmp

Filesize
624KB

Download
memory/5660-124-0x0000000006090000-0x0000000006122000-memory.dmp

Filesize
584KB

Download
memory/5660-308-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Filesize
48KB

Download
memory/5908-118-0x000001C7EDD80000-0x000001C7EDD81000-memory.dmp

Filesize
4KB

Download
memory/6064-281-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-282-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-286-0x00007FFB1DDA0000-0x00007FFB1DDB0000-memory.dmp

Filesize
64KB

Download
memory/6064-287-0x00007FFB1DDA0000-0x00007FFB1DDB0000-memory.dmp

Filesize
64KB

Download
memory/6064-283-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-284-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-285-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-323-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-322-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-325-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download
memory/6064-324-0x00007FFB205F0000-0x00007FFB20600000-memory.dmp

Filesize
64KB

Download