xworm | c10f57b532f8cbf7983097bed166e2b5f450fcb25dcf824ae95f8df462e283fe

Analysis

user interaction
yes
max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dsadas.exe
Size 229KB
Sample260722-sfrqmabp21
SHA256 c10f57b532f8cbf7983097bed166e2b5f450fcb25dcf824ae95f8df462e283fe
MD5 a1391d01e6cae829c243f83223b0def3
SHA1 a80f16fb6f87b231c548d5ff80349da906507fd7
SHA512 2a7b0851541454953f59f69514d79db75336757532b29cfc3a7f052eb1b42627c40bb4e54d4ab2ee0d0a50c14d2824b93fb379dd54d9701b909052c5e88e5c60
SSDEEP 6144:QJWNE95/5bTgVziHzZnSKrCbYMc+bA8Vq:QJF/5/gVziHlBrCbY98s
TLSH
T1FA344A66F6A100FBD4BA42358D636B02B7B2F03617219BEF0B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x000001A80E2E0000-0x000001A80E31E000-memory.dmp	family_xworm
behavioral2/memory/5824-11-0x000001A80E900000-0x000001A80E90E000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
3108	yggpgryw.4yt.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={843F6249-B8FC-4503-AF05-029AF6DF34F2}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784732690"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 21 Jul 2026 19:36:11 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe
3108	yggpgryw.4yt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2088	explorer.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	5824	dsadas.exe
Token: SeDebugPrivilege	3108	yggpgryw.4yt.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe
Token: SeShutdownPrivilege	2088	explorer.exe
Token: SeCreatePagefilePrivilege	2088	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2088	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 3108	5824	dsadas.exe	89
PID 3108 wrote to memory of 740	3108	yggpgryw.4yt.exe	5
PID 3108 wrote to memory of 972	3108	yggpgryw.4yt.exe	9
PID 3108 wrote to memory of 980	3108	yggpgryw.4yt.exe	10
PID 3108 wrote to memory of 988	3108	yggpgryw.4yt.exe	11
PID 3108 wrote to memory of 1028	3108	yggpgryw.4yt.exe	13
PID 3108 wrote to memory of 1088	3108	yggpgryw.4yt.exe	14
PID 3108 wrote to memory of 1144	3108	yggpgryw.4yt.exe	15
PID 3108 wrote to memory of 1220	3108	yggpgryw.4yt.exe	16
PID 3108 wrote to memory of 1268	3108	yggpgryw.4yt.exe	17
PID 3108 wrote to memory of 1336	3108	yggpgryw.4yt.exe	18
PID 3108 wrote to memory of 1424	3108	yggpgryw.4yt.exe	20
PID 3108 wrote to memory of 1520	3108	yggpgryw.4yt.exe	22
PID 3108 wrote to memory of 1600	3108	yggpgryw.4yt.exe	23
PID 3108 wrote to memory of 1656	3108	yggpgryw.4yt.exe	24
PID 3108 wrote to memory of 1712	3108	yggpgryw.4yt.exe	25
PID 3108 wrote to memory of 1720	3108	yggpgryw.4yt.exe	26
PID 3108 wrote to memory of 1868	3108	yggpgryw.4yt.exe	27
PID 3108 wrote to memory of 1976	3108	yggpgryw.4yt.exe	28
PID 3108 wrote to memory of 1996	3108	yggpgryw.4yt.exe	29
PID 3108 wrote to memory of 1420	3108	yggpgryw.4yt.exe	30
PID 3108 wrote to memory of 1828	3108	yggpgryw.4yt.exe	31
PID 3108 wrote to memory of 2200	3108	yggpgryw.4yt.exe	32
PID 3108 wrote to memory of 2224	3108	yggpgryw.4yt.exe	33
PID 3108 wrote to memory of 2252	3108	yggpgryw.4yt.exe	34
PID 3108 wrote to memory of 2368	3108	yggpgryw.4yt.exe	35
PID 3108 wrote to memory of 2404	3108	yggpgryw.4yt.exe	36
PID 3108 wrote to memory of 2456	3108	yggpgryw.4yt.exe	37
PID 3108 wrote to memory of 2556	3108	yggpgryw.4yt.exe	38
PID 3108 wrote to memory of 2604	3108	yggpgryw.4yt.exe	39
PID 3108 wrote to memory of 2636	3108	yggpgryw.4yt.exe	40
PID 3108 wrote to memory of 2748	3108	yggpgryw.4yt.exe	41
PID 3108 wrote to memory of 2924	3108	yggpgryw.4yt.exe	42
PID 3108 wrote to memory of 3012	3108	yggpgryw.4yt.exe	43
PID 3108 wrote to memory of 3024	3108	yggpgryw.4yt.exe	44
PID 3108 wrote to memory of 3100	3108	yggpgryw.4yt.exe	45
PID 3108 wrote to memory of 3128	3108	yggpgryw.4yt.exe	46
PID 3108 wrote to memory of 3240	3108	yggpgryw.4yt.exe	48
PID 3108 wrote to memory of 3464	3108	yggpgryw.4yt.exe	50
PID 3108 wrote to memory of 3628	3108	yggpgryw.4yt.exe	51
PID 3108 wrote to memory of 3680	3108	yggpgryw.4yt.exe	52
PID 3108 wrote to memory of 3688	3108	yggpgryw.4yt.exe	53
PID 3108 wrote to memory of 3700	3108	yggpgryw.4yt.exe	54
PID 3108 wrote to memory of 3728	3108	yggpgryw.4yt.exe	55
PID 3108 wrote to memory of 3776	3108	yggpgryw.4yt.exe	56
PID 3108 wrote to memory of 3264	3108	yggpgryw.4yt.exe	57
PID 3108 wrote to memory of 3868	3108	yggpgryw.4yt.exe	58
PID 3108 wrote to memory of 4360	3108	yggpgryw.4yt.exe	59
PID 3108 wrote to memory of 4416	3108	yggpgryw.4yt.exe	60
PID 3108 wrote to memory of 4460	3108	yggpgryw.4yt.exe	61
PID 3108 wrote to memory of 4672	3108	yggpgryw.4yt.exe	62
PID 3108 wrote to memory of 4728	3108	yggpgryw.4yt.exe	63
PID 3108 wrote to memory of 4192	3108	yggpgryw.4yt.exe	64
PID 3108 wrote to memory of 2580	3108	yggpgryw.4yt.exe	65
PID 3108 wrote to memory of 5180	3108	yggpgryw.4yt.exe	66
PID 3108 wrote to memory of 5448	3108	yggpgryw.4yt.exe	69
PID 3108 wrote to memory of 6128	3108	yggpgryw.4yt.exe	71
PID 3108 wrote to memory of 3420	3108	yggpgryw.4yt.exe	73
PID 3108 wrote to memory of 5948	3108	yggpgryw.4yt.exe	74
PID 3108 wrote to memory of 3772	3108	yggpgryw.4yt.exe	77
PID 3108 wrote to memory of 6108	3108	yggpgryw.4yt.exe	78
PID 3108 wrote to memory of 2388	3108	yggpgryw.4yt.exe	79
PID 3108 wrote to memory of 792	3108	yggpgryw.4yt.exe	80
PID 3108 wrote to memory of 2088	3108	yggpgryw.4yt.exe	81

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1144

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:980

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-70de021d-a2d6-47fa-b531-ccf7c889877c -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-51e38cda-4cd3-4f78-97fa-39430c2b6c84 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-02a42bc1-c2e8-4521-9784-862a6d0fbe88 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-013a1e1f-8682-4d9b-8307-19480ef2be5d -LifetimeId:1ab31f0b-0ec8-4ad1-8655-1a8285b16523 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1996
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:792
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\dsadas.exe
      "C:\Users\Admin\AppData\Local\Temp\dsadas.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\yggpgryw.4yt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yggpgryw.4yt.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2456
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3100

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3240

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4672

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4728

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2580

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:6128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:6108

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2388

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yggpgryw.4yt.exe

Path C:\Users\Admin\AppData\Local\Temp\yggpgryw.4yt.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-20-0x000002B187780000-0x000002B1877AB000-memory.dmp

Download

memory/740-281-0x000002B187780000-0x000002B1877AB000-memory.dmp

Download

memory/740-21-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/740-17-0x000002B187750000-0x000002B187775000-memory.dmp

Download

memory/972-23-0x000002A130000000-0x000002A13002B000-memory.dmp

Download

memory/972-283-0x000002A130000000-0x000002A13002B000-memory.dmp

Download

memory/972-24-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/980-26-0x0000021489440000-0x000002148946B000-memory.dmp

Download

memory/980-282-0x0000021489440000-0x000002148946B000-memory.dmp

Download

memory/980-27-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/988-102-0x0000014E84520000-0x0000014E8454B000-memory.dmp

Download

memory/988-288-0x0000014E84520000-0x0000014E8454B000-memory.dmp

Download

memory/988-103-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1028-107-0x00000165FCF40000-0x00000165FCF6B000-memory.dmp

Download

memory/1028-108-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1088-110-0x0000018C04680000-0x0000018C046AB000-memory.dmp

Download

memory/1088-111-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1144-34-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1144-284-0x000002952B7B0000-0x000002952B7DB000-memory.dmp

Download

memory/1144-33-0x000002952B7B0000-0x000002952B7DB000-memory.dmp

Download

memory/1220-113-0x0000013380F60000-0x0000013380F8B000-memory.dmp

Download

memory/1268-114-0x000001C61EDA0000-0x000001C61EDCB000-memory.dmp

Download

memory/1268-115-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1336-117-0x000001E11FEA0000-0x000001E11FECB000-memory.dmp

Download

memory/1336-118-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1420-130-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1420-129-0x000002392AE70000-0x000002392AE9B000-memory.dmp

Download

memory/1424-120-0x00000273F8E90000-0x00000273F8EBB000-memory.dmp

Download

memory/1424-121-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1600-285-0x0000026017E60000-0x0000026017E8B000-memory.dmp

Download

memory/1600-42-0x0000026017E60000-0x0000026017E8B000-memory.dmp

Download

memory/1600-43-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1656-123-0x000001E91AE50000-0x000001E91AE7B000-memory.dmp

Download

memory/1656-124-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1720-127-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1720-126-0x000001A330720000-0x000001A33074B000-memory.dmp

Download

memory/1828-133-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/1828-132-0x00000264A8D00000-0x00000264A8D2B000-memory.dmp

Download

memory/2088-98-0x0000000002B50000-0x0000000002B7B000-memory.dmp

Download

memory/2088-99-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2088-287-0x0000000002B50000-0x0000000002B7B000-memory.dmp

Download

memory/2200-135-0x00000282456A0000-0x00000282456CB000-memory.dmp

Download

memory/2200-136-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2224-138-0x000002148FEC0000-0x000002148FEEB000-memory.dmp

Download

memory/2224-139-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2252-142-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2252-141-0x000001E22F7D0000-0x000001E22F7FB000-memory.dmp

Download

memory/2404-144-0x000001E960AA0000-0x000001E960ACB000-memory.dmp

Download

memory/2404-145-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2604-150-0x0000024CD5790000-0x0000024CD57BB000-memory.dmp

Download

memory/2604-151-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/2636-147-0x0000025565540000-0x000002556556B000-memory.dmp

Download

memory/2636-148-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3012-153-0x0000025C19340000-0x0000025C1936B000-memory.dmp

Download

memory/3012-154-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3024-156-0x000001A09BD60000-0x000001A09BD8B000-memory.dmp

Download

memory/3024-157-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3100-159-0x0000020DA0C10000-0x0000020DA0C3B000-memory.dmp

Download

memory/3100-160-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3108-13-0x00007FFBE1EE0000-0x00007FFBE2143000-memory.dmp

Download

memory/3108-14-0x00007FFBE1120000-0x00007FFBE11E7000-memory.dmp

Download

memory/3128-165-0x00000000012E0000-0x000000000130B000-memory.dmp

Download

memory/3128-167-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3240-162-0x00000293A7440000-0x00000293A746B000-memory.dmp

Download

memory/3240-163-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3464-169-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/3464-166-0x000002922F680000-0x000002922F6AB000-memory.dmp

Download

memory/3628-171-0x0000017EA5F80000-0x0000017EA5FAB000-memory.dmp

Download

memory/3628-172-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/4192-84-0x0000025293D70000-0x0000025293D9B000-memory.dmp

Download

memory/4192-286-0x0000025293D70000-0x0000025293D9B000-memory.dmp

Download

memory/4192-85-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp

Download

memory/5824-289-0x000001A828C50000-0x000001A828C60000-memory.dmp

Download

memory/5824-16-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5824-0-0x000001A80E2E0000-0x000001A80E31E000-memory.dmp

Download

memory/5824-280-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5824-15-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5824-279-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5824-11-0x000001A80E900000-0x000001A80E90E000-memory.dmp

Download

memory/5824-4-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5824-1-0x00007FFBBF08F000-0x00007FFBBF090000-memory.dmp

Download

memory/5824-2-0x000001A80E760000-0x000001A80E78C000-memory.dmp

Download

memory/5824-290-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download