xworm | 3d16c64448808c38a36430b330e6ea296c752f924291c21df0f33cea4e86e27d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/02/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
io.exe
Size 229KB
Sample260221-e1aqyshs2h
SHA256 3d16c64448808c38a36430b330e6ea296c752f924291c21df0f33cea4e86e27d
MD5 88d54e85177293f63c9f59d38c35842e
SHA1 3daf436fe4e31e4a54d9e651432f9af1910ce1f6
SHA512 09cca7ea349d4cbb576c2cfd4f8c88970d451a2ded7409972c6fc4bbd9281343a9d6c560d39458632dacf9dd79a3f72cfcb45d0517a82a3e8e8ded7a8c8ed984
SSDEEP 3072:mO4FE9RGOq8eLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN9:mpE9y/5bTgVziHzZnSKrCbYMr2bx8Vq
TLSH
T1DA344A66F6A100FBD4BA42358D635B02B7B2F03617219BEF0B94496D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

porfs.servehalflife.com:4444

Attributes

install_file
Mason.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4004-0-0x0000015C73200000-0x0000015C7323E000-memory.dmp	family_xworm
behavioral2/memory/4004-303-0x0000015C750E0000-0x0000015C750EE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
4136	upa0xk1u.j1c.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1771647937"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={5D72B851-AF7B-4408-92BD-2C1E6D4D7B17}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 21 Feb 2026 04:25:37 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
824	SCHTASKS.exe
2608	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe
4136	upa0xk1u.j1c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3172	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	io.exe
Token: SeDebugPrivilege	4136	upa0xk1u.j1c.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeAuditPrivilege	2724	svchost.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	456	dwm.exe
Token: SeCreatePagefilePrivilege	456	dwm.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3172	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3172	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4136	4004	io.exe	82
PID 4004 wrote to memory of 824	4004	io.exe	83
PID 4136 wrote to memory of 640	4136	upa0xk1u.j1c.exe	5
PID 4136 wrote to memory of 692	4136	upa0xk1u.j1c.exe	7
PID 4136 wrote to memory of 852	4136	upa0xk1u.j1c.exe	11
PID 4136 wrote to memory of 408	4136	upa0xk1u.j1c.exe	13
PID 4136 wrote to memory of 456	4136	upa0xk1u.j1c.exe	14
PID 4136 wrote to memory of 1028	4136	upa0xk1u.j1c.exe	15
PID 4136 wrote to memory of 1064	4136	upa0xk1u.j1c.exe	16
PID 4136 wrote to memory of 1140	4136	upa0xk1u.j1c.exe	18
PID 4136 wrote to memory of 1212	4136	upa0xk1u.j1c.exe	19
PID 4136 wrote to memory of 1224	4136	upa0xk1u.j1c.exe	20
PID 4136 wrote to memory of 1280	4136	upa0xk1u.j1c.exe	21
PID 4136 wrote to memory of 1304	4136	upa0xk1u.j1c.exe	22
PID 4136 wrote to memory of 1324	4136	upa0xk1u.j1c.exe	23
PID 4136 wrote to memory of 1392	4136	upa0xk1u.j1c.exe	24
PID 4136 wrote to memory of 1420	4136	upa0xk1u.j1c.exe	25
PID 4136 wrote to memory of 1512	4136	upa0xk1u.j1c.exe	26
PID 4136 wrote to memory of 1748	4136	upa0xk1u.j1c.exe	27
PID 4136 wrote to memory of 1792	4136	upa0xk1u.j1c.exe	28
PID 4136 wrote to memory of 1812	4136	upa0xk1u.j1c.exe	29
PID 4136 wrote to memory of 1864	4136	upa0xk1u.j1c.exe	30
PID 4136 wrote to memory of 1876	4136	upa0xk1u.j1c.exe	31
PID 4136 wrote to memory of 1916	4136	upa0xk1u.j1c.exe	32
PID 4136 wrote to memory of 2004	4136	upa0xk1u.j1c.exe	33
PID 4136 wrote to memory of 2040	4136	upa0xk1u.j1c.exe	34
PID 4136 wrote to memory of 556	4136	upa0xk1u.j1c.exe	35
PID 4136 wrote to memory of 1684	4136	upa0xk1u.j1c.exe	36
PID 4136 wrote to memory of 2112	4136	upa0xk1u.j1c.exe	37
PID 4136 wrote to memory of 2192	4136	upa0xk1u.j1c.exe	38
PID 4136 wrote to memory of 2320	4136	upa0xk1u.j1c.exe	39
PID 4136 wrote to memory of 2456	4136	upa0xk1u.j1c.exe	41
PID 4136 wrote to memory of 2520	4136	upa0xk1u.j1c.exe	42
PID 4136 wrote to memory of 2680	4136	upa0xk1u.j1c.exe	43
PID 4136 wrote to memory of 2696	4136	upa0xk1u.j1c.exe	45
PID 4136 wrote to memory of 2704	4136	upa0xk1u.j1c.exe	46
PID 4136 wrote to memory of 2724	4136	upa0xk1u.j1c.exe	47
PID 4136 wrote to memory of 2836	4136	upa0xk1u.j1c.exe	48
PID 4136 wrote to memory of 2844	4136	upa0xk1u.j1c.exe	49
PID 4136 wrote to memory of 2852	4136	upa0xk1u.j1c.exe	50
PID 4136 wrote to memory of 1356	4136	upa0xk1u.j1c.exe	51
PID 4136 wrote to memory of 2812	4136	upa0xk1u.j1c.exe	52
PID 4136 wrote to memory of 3172	4136	upa0xk1u.j1c.exe	53
PID 4136 wrote to memory of 3300	4136	upa0xk1u.j1c.exe	54
PID 4136 wrote to memory of 3320	4136	upa0xk1u.j1c.exe	55
PID 4136 wrote to memory of 3668	4136	upa0xk1u.j1c.exe	58
PID 4136 wrote to memory of 3724	4136	upa0xk1u.j1c.exe	59
PID 4136 wrote to memory of 3796	4136	upa0xk1u.j1c.exe	60
PID 4136 wrote to memory of 3864	4136	upa0xk1u.j1c.exe	61
PID 4136 wrote to memory of 4128	4136	upa0xk1u.j1c.exe	62
PID 4136 wrote to memory of 4372	4136	upa0xk1u.j1c.exe	63
PID 4136 wrote to memory of 2304	4136	upa0xk1u.j1c.exe	67
PID 4136 wrote to memory of 908	4136	upa0xk1u.j1c.exe	68
PID 4136 wrote to memory of 2752	4136	upa0xk1u.j1c.exe	69
PID 4136 wrote to memory of 4568	4136	upa0xk1u.j1c.exe	70
PID 4136 wrote to memory of 4416	4136	upa0xk1u.j1c.exe	72
PID 4136 wrote to memory of 1004	4136	upa0xk1u.j1c.exe	73
PID 4136 wrote to memory of 460	4136	upa0xk1u.j1c.exe	74
PID 4136 wrote to memory of 4124	4136	upa0xk1u.j1c.exe	75
PID 4136 wrote to memory of 4896	4136	upa0xk1u.j1c.exe	76
PID 4136 wrote to memory of 1660	4136	upa0xk1u.j1c.exe	77
PID 4136 wrote to memory of 4004	4136	upa0xk1u.j1c.exe	81
PID 3172 wrote to memory of 2868	3172	Explorer.EXE
PID 4136 wrote to memory of 2868	4136	upa0xk1u.j1c.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:456

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7482e233-8ea7-4e34-a36c-b1f4f563f085 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2ba1bac8-35a8-4896-8557-99d20549a5ed -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f1ee838c-5b62-48b6-9aa0-5fc03a9a090b -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e455d47a-d025-42b5-b8f6-75390ae4af29 -LifetimeId:b9a8df9f-7a7b-434b-a1ce-221c3a0c4292 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1512
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2192

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2812

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\io.exe
  "C:\Users\Admin\AppData\Local\Temp\io.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\upa0xk1u.j1c.exe
    "C:\Users\Admin\AppData\Local\Temp\upa0xk1u.j1c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4136
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonio.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\io.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:824
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonio.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\io.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3320

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3668

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3864

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4568

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1004

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4124

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1660

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4008

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

upa0xk1u.j1c.exe

Path C:\Users\Admin\AppData\Local\Temp\upa0xk1u.j1c.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-63-0x0000018582F80000-0x0000018582FAB000-memory.dmp

Download

memory/408-33-0x0000018582F80000-0x0000018582FAB000-memory.dmp

Download

memory/408-34-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/408-38-0x0000018582F80000-0x0000018582FAB000-memory.dmp

Download

memory/456-27-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/456-26-0x000001A89B870000-0x000001A89B89B000-memory.dmp

Download

memory/456-36-0x000001A89B870000-0x000001A89B89B000-memory.dmp

Download

memory/556-141-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/556-140-0x0000026534C60000-0x0000026534C8B000-memory.dmp

Download

memory/640-20-0x000002C340F50000-0x000002C340F7B000-memory.dmp

Download

memory/640-14-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/640-12-0x000002C340F20000-0x000002C340F45000-memory.dmp

Download

memory/640-13-0x000002C340F50000-0x000002C340F7B000-memory.dmp

Download

memory/692-21-0x0000020C1C990000-0x0000020C1C9BB000-memory.dmp

Download

memory/692-22-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/692-17-0x0000020C1C990000-0x0000020C1C9BB000-memory.dmp

Download

memory/852-62-0x000001B133380000-0x000001B1333AB000-memory.dmp

Download

memory/852-30-0x000001B133380000-0x000001B1333AB000-memory.dmp

Download

memory/852-37-0x000001B133380000-0x000001B1333AB000-memory.dmp

Download

memory/852-31-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1028-346-0x000001CE6B2E0000-0x000001CE6B30B000-memory.dmp

Download

memory/1028-41-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1028-40-0x000001CE6B2E0000-0x000001CE6B30B000-memory.dmp

Download

memory/1028-39-0x000001CE6B2E0000-0x000001CE6B30B000-memory.dmp

Download

memory/1028-84-0x000001CE6B2E0000-0x000001CE6B30B000-memory.dmp

Download

memory/1064-44-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1064-298-0x00000180D2E90000-0x00000180D2EBB000-memory.dmp

Download

memory/1064-43-0x00000180D2E90000-0x00000180D2EBB000-memory.dmp

Download

memory/1064-46-0x00000180D2E90000-0x00000180D2EBB000-memory.dmp

Download

memory/1140-49-0x000001422C370000-0x000001422C39B000-memory.dmp

Download

memory/1140-50-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1140-327-0x000001422C370000-0x000001422C39B000-memory.dmp

Download

memory/1140-55-0x000001422C370000-0x000001422C39B000-memory.dmp

Download

memory/1212-53-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1212-328-0x000001F709710000-0x000001F70973B000-memory.dmp

Download

memory/1212-52-0x000001F709710000-0x000001F70973B000-memory.dmp

Download

memory/1212-56-0x000001F709710000-0x000001F70973B000-memory.dmp

Download

memory/1224-59-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1224-329-0x000001B7D2060000-0x000001B7D208B000-memory.dmp

Download

memory/1224-58-0x000001B7D2060000-0x000001B7D208B000-memory.dmp

Download

memory/1224-61-0x000001B7D2060000-0x000001B7D208B000-memory.dmp

Download

memory/1280-80-0x0000021E7AE00000-0x0000021E7AE2B000-memory.dmp

Download

memory/1280-332-0x0000021E7AE00000-0x0000021E7AE2B000-memory.dmp

Download

memory/1280-69-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1280-68-0x0000021E7AE00000-0x0000021E7AE2B000-memory.dmp

Download

memory/1304-333-0x000001F2807C0000-0x000001F2807EB000-memory.dmp

Download

memory/1304-81-0x000001F2807C0000-0x000001F2807EB000-memory.dmp

Download

memory/1304-72-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1304-71-0x000001F2807C0000-0x000001F2807EB000-memory.dmp

Download

memory/1324-75-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1324-74-0x000001A2C81A0000-0x000001A2C81CB000-memory.dmp

Download

memory/1324-334-0x000001A2C81A0000-0x000001A2C81CB000-memory.dmp

Download

memory/1324-82-0x000001A2C81A0000-0x000001A2C81CB000-memory.dmp

Download

memory/1392-83-0x00000226E3A00000-0x00000226E3A2B000-memory.dmp

Download

memory/1392-335-0x00000226E3A00000-0x00000226E3A2B000-memory.dmp

Download

memory/1392-77-0x00000226E3A00000-0x00000226E3A2B000-memory.dmp

Download

memory/1392-78-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1420-108-0x0000027996890000-0x00000279968BB000-memory.dmp

Download

memory/1420-109-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1420-337-0x0000027996890000-0x00000279968BB000-memory.dmp

Download

memory/1420-179-0x0000027996890000-0x00000279968BB000-memory.dmp

Download

memory/1512-112-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1512-338-0x0000020238000000-0x000002023802B000-memory.dmp

Download

memory/1512-111-0x0000020238000000-0x000002023802B000-memory.dmp

Download

memory/1512-180-0x0000020238000000-0x000002023802B000-memory.dmp

Download

memory/1684-143-0x000001F567040000-0x000001F56706B000-memory.dmp

Download

memory/1684-144-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1748-115-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1748-114-0x000002A297D10000-0x000002A297D3B000-memory.dmp

Download

memory/1748-181-0x000002A297D10000-0x000002A297D3B000-memory.dmp

Download

memory/1748-339-0x000002A297D10000-0x000002A297D3B000-memory.dmp

Download

memory/1792-340-0x00000206DEE80000-0x00000206DEEAB000-memory.dmp

Download

memory/1792-119-0x00000206DEE80000-0x00000206DEEAB000-memory.dmp

Download

memory/1792-120-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1792-182-0x00000206DEE80000-0x00000206DEEAB000-memory.dmp

Download

memory/1812-122-0x0000019879790000-0x00000198797BB000-memory.dmp

Download

memory/1812-341-0x0000019879790000-0x00000198797BB000-memory.dmp

Download

memory/1812-183-0x0000019879790000-0x00000198797BB000-memory.dmp

Download

memory/1812-123-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1864-126-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1864-342-0x0000020F9FD20000-0x0000020F9FD4B000-memory.dmp

Download

memory/1864-125-0x0000020F9FD20000-0x0000020F9FD4B000-memory.dmp

Download

memory/1864-184-0x0000020F9FD20000-0x0000020F9FD4B000-memory.dmp

Download

memory/1876-128-0x00000277622C0000-0x00000277622EB000-memory.dmp

Download

memory/1876-129-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1876-185-0x00000277622C0000-0x00000277622EB000-memory.dmp

Download

memory/1916-132-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/1916-131-0x000001192ED30000-0x000001192ED5B000-memory.dmp

Download

memory/2004-135-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2004-134-0x0000022AB5DD0000-0x0000022AB5DFB000-memory.dmp

Download

memory/2040-137-0x000001C521E90000-0x000001C521EBB000-memory.dmp

Download

memory/2040-138-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2112-146-0x0000020586950000-0x000002058697B000-memory.dmp

Download

memory/2112-147-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2192-149-0x0000016F03460000-0x0000016F0348B000-memory.dmp

Download

memory/2192-150-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2320-152-0x0000000000BE0000-0x0000000000C0B000-memory.dmp

Download

memory/2320-153-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2456-156-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2456-155-0x000001EB10240000-0x000001EB1026B000-memory.dmp

Download

memory/2520-159-0x00007FF99F270000-0x00007FF99F280000-memory.dmp

Download

memory/2520-158-0x0000024C37660000-0x0000024C3768B000-memory.dmp

Download

memory/2680-161-0x000001C6BDBF0000-0x000001C6BDC1B000-memory.dmp

Download

memory/4004-330-0x0000015C750D0000-0x0000015C750E0000-memory.dmp

Download

memory/4004-303-0x0000015C750E0000-0x0000015C750EE000-memory.dmp

Download

memory/4004-0-0x0000015C73200000-0x0000015C7323E000-memory.dmp

Download

memory/4004-343-0x0000015C750D0000-0x0000015C750E0000-memory.dmp

Download

memory/4004-1-0x0000015C74F40000-0x0000015C74F6C000-memory.dmp

Download

memory/4136-10-0x00007FF9DF1E0000-0x00007FF9DF3E9000-memory.dmp

Download

memory/4136-11-0x00007FF9DE240000-0x00007FF9DE2FD000-memory.dmp

Download