xworm | hxxps://surl[.]li/pbjfny

Analysis

max time kernel
100s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2025, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://surl.li/pbjfny

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

26.ip.gl.ply.gg:19697

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002af83-204.dat	family_xworm
behavioral1/memory/1492-206-0x0000000000970000-0x0000000000986000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
104	powershell.exe
4700	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1492	Seliware.exe
3028	Seliware.exe
4064	Seliware.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SeliwareBootstrapper.7z:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2652	msedge.exe
2652	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
1764	msedge.exe
1764	msedge.exe
5032	msedge.exe
5032	msedge.exe
104	powershell.exe
104	powershell.exe
104	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
1492	Seliware.exe
1492	Seliware.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5088	7zFM.exe
1728	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	5088	7zFM.exe
Token: 35	5088	7zFM.exe
Token: SeSecurityPrivilege	5088	7zFM.exe
Token: SeDebugPrivilege	1492	Seliware.exe
Token: SeDebugPrivilege	104	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	1492	Seliware.exe
Token: SeDebugPrivilege	3028	Seliware.exe
Token: SeRestorePrivilege	1728	7zFM.exe
Token: 35	1728	7zFM.exe
Token: SeDebugPrivilege	4064	Seliware.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
5088	7zFM.exe
5088	7zFM.exe
1728	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3520	OpenWith.exe
3520	OpenWith.exe
3520	OpenWith.exe
1492	Seliware.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4932	2652	msedge.exe	81
PID 2652 wrote to memory of 4932	2652	msedge.exe	81
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 1544	2652	msedge.exe	82
PID 2652 wrote to memory of 2076	2652	msedge.exe	83
PID 2652 wrote to memory of 2076	2652	msedge.exe	83
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84
PID 2652 wrote to memory of 4532	2652	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://surl.li/pbjfny
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb91933cb8,0x7ffb91933cc8,0x7ffb91933cd8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16204610549544975065,4180839740197886659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3520

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SeliwareBootstrapper.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5088

C:\Users\Admin\Desktop\Seliware.exe
"C:\Users\Admin\Desktop\Seliware.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Seliware.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Seliware.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700

C:\Users\Admin\Desktop\Seliware.exe
"C:\Users\Admin\Desktop\Seliware.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SeliwareBootstrapper.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1728

C:\Users\Admin\Desktop\Seliware.exe
"C:\Users\Admin\Desktop\Seliware.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Seliware.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
825fb95a70bf7b56cfcda1f118800f98

SHA1
15f1e212c1fb567c70ff4f716a4bba81f2857e0a

SHA256
2280c42f8ca4302a1d37d63532e3e981e33b596e3b2e930ce40b390dc0f09104

SHA512
987189b84f58e5d64b662f80f47ae797bcf46aeba86584cc17afabd2f25885a4cf48d80400154ba22eeee1131b84f882cd1998d1686ee12013218f52049bc6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e45a14e89fdf82756edc65c97e606e63

SHA1
42ce594393a4ce3b4e1c79dbe424841bd3f434c8

SHA256
49af9d716c69fb93ebee18e708f4ceaab99abf505abcbad1bd46c60ace03da9f

SHA512
6af0cabb253026d7613065e7274f8be114fc2cbd0134e8d518a417bf4b2b94ffc8b9c05be4e47685ac6d7246e28c11a86852ee4b6e934bf6c6d56b6c97428425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
f2e690368638f5ce0a676b886b9b4462

SHA1
5cee1b0932ef223e6b88a733343297c30375ad9f

SHA256
a386f01cc2b3dff9f7f8fdc69c6f2eaa691698881c4162b5d72b241afa6a1232

SHA512
7093fe9a1a5d129e3dc6f4dd7bab821b58af63aed34df211baf9392009b8d46b016fe14ed2ee10ba16df368616a20035df3ff11db6c1f30287f8de412f571880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
903c2449371929de21ac0d002b05232a

SHA1
7d15a56e6f49cbc24a4015ffa580ebb9e6684705

SHA256
9f51a4e3d5e965f1db6212868974c11a618320c99659533b78c4305aeb1f50e1

SHA512
3c702a2b055a43875ae75bd618a37fa57792f289a0b0aebf31386303ab8d98efbbba2c29536a2956e6b0e377a7d0a984bf0d1e636c90cc84e4527fa213d446e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09474e2435a238952a92d3afaffa5a04

SHA1
832ec54c950ec7ea1455c02e64527ffaa49cd67f

SHA256
91df887310bcb5fb90120f342fe19817555ccf976911868a82abb1ad386afe96

SHA512
be01b7bf2431dcd240b58bb14249992d7a26b17408e349585eb9306f41895bf3cf56d239052d25c845e5432c4ee9053b3b795171b3c37db20ff7ca01d1ba755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec595c4b29fe1dd0f9e0f5edb104e726

SHA1
af882237a738bac80d35c9540a54da44ea905267

SHA256
9c6b35b3b076a936b255dbef546823a99afa591231ea1b6d58931c79e80920bf

SHA512
9af03893f30e822f1a3444f5c35dc1805a6fd057ed7356a0a8dea2746ab7f10fde6a2ba1c5990f8d4984e3a4b321df722b89f80bb0f7db0a07455d359af3c1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
525cb6deebc24f37374f97250153112a

SHA1
6b43b083ce6012a9e29f3a23308450945eb1f2a0

SHA256
4b919e5271b7ea55d8b529083bc4971b68569e806a1b33331dd43d0745dbd515

SHA512
dcf8dcf14a8b92601559cae2d085df84a754fa33c149db656d9db2fe5aace8deb3709717e901947f77be5a34c05f34289918ca3a93b76bac408c25c505fa47c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a1863dbf3d839137e405181d08cef018

SHA1
4ca07172478a02b8d29210621c7d0da488e1fd5b

SHA256
3436fbadbdb2a4263cea411274186fbed26472147cb538dc6bcbdf27ca3e1b98

SHA512
1584a6fa083de6b1ed1eb04d3af7edc5fb469a804d0070a9c91007067cb040ff0f7a404ded4dd6cb88dffaeabd73649575a4c9c5ae2b798fde4df3321f3270e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
636d646245726d091947be2a9b79a502

SHA1
dc010bd55bc04fae708d318cd154ce22bcf698e7

SHA256
4e9ffa0723b4ec72c89398b9601a92b9588251142e10eb95e8299bbefff12e21

SHA512
f19ef5bfd1786d3b0a91f306a9537c5312f96288ebf65010d63dcd7f50cecd3fc0eb0777962f21841e3a64a6045d7d0e12cb1a0d16a3b09c357560e96a59c502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ca5bb882d0d287a29f854690cd2fe15

SHA1
09fe5d1db0ad927039f867102f5b8d9f8b5c8986

SHA256
6943529ab543e64fee0dc26e4bcc96a2094437e85ac22a08a7a76d5d38dcd7e6

SHA512
99dd8f2b13b2491ef8cf848587778913e4829b6786bb95380d1481d41b4d1282be2e8bbde0ce3490cb3595f8f9754952bb32f7dc8c43b8591f7c5dad38dc5f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f9766fde4923338d1f998f48fe056b9

SHA1
ad54fc17a38e763af33b9cbe2342379f898a8ac4

SHA256
af84fb1828b135671a4545a7ececf4cffa44403d0e0c905802e9bd9aa6a04c5e

SHA512
808a10a91e59b3ea45899d136379187d47d431f0a28c34420c243b2450c936860a7594e9b56886f254942633df1118940b89ada6f7f9e2025891ce3727c1a052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6903d57eed54e89b68ebb957928d1b99

SHA1
fade011fbf2e4bc044d41e380cf70bd6a9f73212

SHA256
36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

SHA512
c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0omhr13r.iyb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Seliware.exe

Filesize
59KB

MD5
97b4aba69863eaee1d4526be697e2f23

SHA1
e1e277f7a7054371c83b8c09af1f6fcf1b5efff5

SHA256
5884a6fbd79822f1ff0c60b568b2ed16c59822bcb9e715d29efe3e2eaf1b9e5d

SHA512
76a924b62cfcb305809652556228cff971d1aab03d80551be929a0e8786f059d93a8d6851d2611c46a689ddce11383a0df62146b191bf4380ef4413d7b9873ff

Download Submit
C:\Users\Admin\Downloads\SeliwareBootstrapper.7z

Filesize
31KB

MD5
529887971a269a3d7cd3a5d1b1ef5a46

SHA1
cb4cdcb74c574792ee6826d59ce6ddb81cd9d075

SHA256
51f12fb9dd6ac5fa49a741ad5905ed7cef12c748e18a5160ab3c075cfd0bf28e

SHA512
65ac1458a2852407a725590a54528c5b187a5a1bca306a8f17b607c4c0e7f2065ac67791e37711429647c9d19ddb37eba81a7140dec8a36eb64cc85050ac5a4e

Download Submit
C:\Users\Admin\Downloads\SeliwareBootstrapper.7z:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/104-212-0x000002CBC8D30000-0x000002CBC8D52000-memory.dmp

Filesize
136KB

Download
memory/1492-206-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download