xworm | 03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shipping Detailst.vbs
Size 2.4MB
Sample260820-jf5g2ssclb
SHA256 03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1
MD5 2dd19c1ab7885a0c89206917adc6f03d
SHA1 ae571089bd1a730338d072115fd05353d3d91ed6
SHA512 af95949060971a2692ecb012da1bd1106f20eb6a41ea961ef5f3e04d00276913f32579e70f9f5b0d863acdd530357239639b8cf985dbb147013e91da452e9718
SSDEEP 768:eoP5YTdCk1sFm/jlD7jBB6+/CNcgc16+CSqqB/+KcqCpi7JvvqvWVdvvaN2JIl3Y:y9
TLSH
T1B0C57D606F3B8975DE24FEAB617046E01BC9830A1497CB805CC6DE5B4EE5BB099BDC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution xworm persistence privilege_escalation rat trojan upx

Malware Config

Extracted

Family

xworm

Version

halakw.com:7004

Mutex

zTQNrZyAgDf4NZxY

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5580-27-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5692	2332	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5692	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5692	powershell.exe
2968	powershell.exe
6024	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
18	5580	Caspol.exe
15	5580	Caspol.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6140	netsh.exe
2404	netsh.exe

Executes dropped EXE 7 IoCs

pid	Process
4164	vontteSecurityHealthService.exe
4516	SecurtyHeathService.exe
3604	SecurtyHeathService.exe
5368	fjoquzclient.exe
4644	diskdiag.exe
2368	diskdiag.exe
6036	diskdiag.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
19	pastebin.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1492	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5692 set thread context of 5580	5692	powershell.exe	98

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000300000001a27c-42.dat	upx
behavioral2/memory/4164-46-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4164-57-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3144	cmd.exe
6100	cmd.exe
1132	cmd.exe
2484	cmd.exe
2792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vontteSecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3336	schtasks.exe
3296	schtasks.exe
4892	schtasks.exe
2068	schtasks.exe
760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	powershell.exe
5692	powershell.exe
2968	powershell.exe
2968	powershell.exe
5692	powershell.exe
5692	powershell.exe
5580	Caspol.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe
4516	SecurtyHeathService.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5580	Caspol.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeIncreaseQuotaPrivilege	6024	powershell.exe
Token: SeSecurityPrivilege	6024	powershell.exe
Token: SeTakeOwnershipPrivilege	6024	powershell.exe
Token: SeLoadDriverPrivilege	6024	powershell.exe
Token: SeSystemProfilePrivilege	6024	powershell.exe
Token: SeSystemtimePrivilege	6024	powershell.exe
Token: SeProfSingleProcessPrivilege	6024	powershell.exe
Token: SeIncBasePriorityPrivilege	6024	powershell.exe
Token: SeCreatePagefilePrivilege	6024	powershell.exe
Token: SeBackupPrivilege	6024	powershell.exe
Token: SeRestorePrivilege	6024	powershell.exe
Token: SeShutdownPrivilege	6024	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeSystemEnvironmentPrivilege	6024	powershell.exe
Token: SeRemoteShutdownPrivilege	6024	powershell.exe
Token: SeUndockPrivilege	6024	powershell.exe
Token: SeManageVolumePrivilege	6024	powershell.exe
Token: 33	6024	powershell.exe
Token: 34	6024	powershell.exe
Token: 35	6024	powershell.exe
Token: 36	6024	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2968	1492	WScript.exe	92
PID 5692 wrote to memory of 1132	5692	powershell.exe	94
PID 5692 wrote to memory of 5580	5692	powershell.exe	98
PID 5692 wrote to memory of 5580	5692	powershell.exe	98
PID 5692 wrote to memory of 5580	5692	powershell.exe	98
PID 5692 wrote to memory of 5580	5692	powershell.exe	98
PID 5692 wrote to memory of 5580	5692	powershell.exe	98
PID 5580 wrote to memory of 4164	5580	Caspol.exe	100
PID 4164 wrote to memory of 2484	4164	vontteSecurityHealthService.exe	101
PID 2484 wrote to memory of 4516	2484	cmd.exe	103
PID 4516 wrote to memory of 2792	4516	SecurtyHeathService.exe	104
PID 2792 wrote to memory of 2640	2792	cmd.exe	106
PID 4516 wrote to memory of 3144	4516	SecurtyHeathService.exe	107
PID 3144 wrote to memory of 5908	3144	cmd.exe	109
PID 4516 wrote to memory of 6100	4516	SecurtyHeathService.exe	110
PID 6100 wrote to memory of 3336	6100	cmd.exe	112
PID 5580 wrote to memory of 5368	5580	Caspol.exe	115
PID 5368 wrote to memory of 3296	5368	fjoquzclient.exe	116
PID 5368 wrote to memory of 4892	5368	fjoquzclient.exe	117
PID 5368 wrote to memory of 4644	5368	fjoquzclient.exe	120
PID 2368 wrote to memory of 6024	2368	diskdiag.exe	125
PID 2368 wrote to memory of 6140	2368	diskdiag.exe	126
PID 2368 wrote to memory of 2404	2368	diskdiag.exe	127
PID 2368 wrote to memory of 760	2368	diskdiag.exe	128
PID 2368 wrote to memory of 2068	2368	diskdiag.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Detailst.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('JDGttDpzY9yjP6o8jykrlo2pnxprujFjExRawQ79IHXStVPHKXJ1fcA/H0kLw1yI','FMPmGC6SGv3bQWgA+0gPzroAPylr4C5Eezcuu2em0xA=','dFQoEDwJ7jH/kT4qM5hZqr1y9SYSedz2KV+oTj9NqocR0urAeH8wKFrboc/TolGq','ejbdQKU/ScuwNSWftqc+lPvuIsPf/+J1y/4Cc6MyRds=','Lq5fm0NAStPXMJ1f1fhdU8DAiXNj9Xbns+Z6BFo5Lh0=','','fbcaASK+GVfpkzp9oz1wTFiqc4WW434qAjkIa0QwFXs=','rpKPdBr9zAMWAmeatopGkiTmIB/4FzxG1J37bRBawUM=','Xe/Xr0L4VWHQoLmNiA+pO8pJftAelGMCwh9SEM8DqT2Y7Swgpz+di2hFfZc747GE','9Q2S3vXadWIiZxrjBfpZcmy2oJGUVO2hDJFj6iusTxNZbDAJX+TOD7rtnmR8ICWR','p2LgkRl0QpscMlEZW+k0Iz9gLujfCkR2YvyTD7c4Btg=','dn6ePQ/oCEztonUTzjeffmQo+ooYkVgMFm60EWdd7vI=','SuDaJ9AHnNNmSLQOp7c2vn1jv37beHiQjoJ9l1ZwuIk=','Xq7w5pGRDLRjQ2fiTyjI212/zDE+uTlL7jx1V2vYMMU=','M+0yA3kL20vmsOlkzYxBMrQDMuoOxMjQQrpD+lLChhs=','KyBkARui5lxVOoibmAYLqMOjzmbs/4QJkCrStcF8fyE=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('JDGttDpzY9yjP6o8jykrlo2pnxprujFjExRawQ79IHXStVPHKXJ1fcA/H0kLw1yI','FMPmGC6SGv3bQWgA+0gPzroAPylr4C5Eezcuu2em0xA=','dFQoEDwJ7jH/kT4qM5hZqr1y9SYSedz2KV+oTj9NqocR0urAeH8wKFrboc/TolGq','ejbdQKU/ScuwNSWftqc+lPvuIsPf/+J1y/4Cc6MyRds=','Lq5fm0NAStPXMJ1f1fhdU8DAiXNj9Xbns+Z6BFo5Lh0=','','fbcaASK+GVfpkzp9oz1wTFiqc4WW434qAjkIa0QwFXs=','rpKPdBr9zAMWAmeatopGkiTmIB/4FzxG1J37bRBawUM=','Xe/Xr0L4VWHQoLmNiA+pO8pJftAelGMCwh9SEM8DqT2Y7Swgpz+di2hFfZc747GE','9Q2S3vXadWIiZxrjBfpZcmy2oJGUVO2hDJFj6iusTxNZbDAJX+TOD7rtnmR8ICWR','p2LgkRl0QpscMlEZW+k0Iz9gLujfCkR2YvyTD7c4Btg=','dn6ePQ/oCEztonUTzjeffmQo+ooYkVgMFm60EWdd7vI=','SuDaJ9AHnNNmSLQOp7c2vn1jv37beHiQjoJ9l1ZwuIk=','Xq7w5pGRDLRjQ2fiTyjI212/zDE+uTlL7jx1V2vYMMU=','M+0yA3kL20vmsOlkzYxBMrQDMuoOxMjQQrpD+lLChhs=','KyBkARui5lxVOoibmAYLqMOjzmbs/4QJkCrStcF8fyE=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\\Users\\Public\\Libraries\\dFVGaCvthu.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:1132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Downloads MZ/PE file
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5580
- - C:\Users\Admin\AppData\Local\Temp\vontteSecurityHealthService.exe
    "C:\Users\Admin\AppData\Local\Temp\vontteSecurityHealthService.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\88AA.tmp\88AB.tmp\88AC.bat C:\Users\Admin\AppData\Local\Temp\vontteSecurityHealthService.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe
        
        "SecurtyHeathService.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /query /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent" >nul 2>&1
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent"
        7⤵
        
        PID:2640
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /query /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent" >nul 2>&1
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent"
        7⤵
        
        PID:5908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent" /tr "'C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe'" /sc onlogon /rl highest /f >nul 2>&1
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "\Microsoft\Windows\SecurityHealth\SecurityHealthAgent" /tr "'C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe'" /sc onlogon /rl highest /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3336
- - C:\Users\Admin\AppData\Local\Temp\fjoquzclient.exe
    "C:\Users\Admin\AppData\Local\Temp\fjoquzclient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3296
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4892
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"
      4⤵
      Executes dropped EXE
      PID:4644

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3540

C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe
"C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe"
1⤵
- Executes dropped EXE
PID:3604

C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' -ExclusionProcess 'diskdiag.exe' -ExclusionExtension '.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6140
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2404
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:760
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2068

C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 02240654137773621b3840ae34250aa67e87948c785c9cde1aa66590a41f1d8b
MD5 c230c2f9cb201b5ce3d4dc60d44e3122
SHA1 8252d647d7fd1ed790fc71a3be65088006f1e180
SHA512 7340e8bca6f3600c313f2c1bb361d5b69f4e0ccbbce110887c3fcd46bb60a1c125d272650d18f3dccd4c11ed15249412dcd4b892783045f0968cb14524609ffe
MD5 SHA1 SHA512

Submit Download

88AC.bat

Path C:\Users\Admin\AppData\Local\Temp\88AA.tmp\88AB.tmp\88AC.bat
Size 36B
SHA256 c37fb91f6115e42f32674f9996b387b75052e342f8d1dc9efc38a2b7af859d32
MD5 dba0cf0e83da128296110f8575acd36d
SHA1 4e11ebb6247626741b2b6f7c5d3e2449949b0cff
SHA512 1e660ad915eb7e746eda0d46251206ce33a7d5d5921aa16ea16a7bb597d93574e85ecf9196fe02d051e5368ed49b7a357347cefab400c4a94c44a1997de9ac69
MD5 SHA1 SHA512

Submit Download

SecurtyHeathService.exe

Path C:\Users\Admin\AppData\Local\Temp\88AA.tmp\SecurtyHeathService.exe
Size 69KB
SHA256 4d8b62700859ef75d83f4a70b90fd25812642e809dfc1d360ebf1f8eccddd4ae
MD5 c364c0984617d7332b5d83c5cf16b15e
SHA1 3564842c16d5c1df7a75c2ca0c4f7337f9783a7b
SHA512 d4e9235a6cadb860b9656b6b024257e15181cc60910360b7d6f3a0e8da7d9a4eef43671ac0e18de4df22fcbe8d59db2754a81bea12f6d0c3ad0c4be707baa44c
SSDEEP 1536:t8jRCqZsBbL9sul+xkvCc+gRdp7XOBqzy:tQDs12ussCAP9Ty
TLSH
T169632A1FB34320FCC61AD1758AEA6333EF72B86607318B6F1A64D6746E34A406E6D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sm4vipnp.2jm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sm4vipnp.2jm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fjoquzclient.exe

Path C:\Users\Admin\AppData\Local\Temp\fjoquzclient.exe
Size 37KB
SHA256 6c03a02ccbf0d1b28709d7df24eecd14d64822851ad881531959b05ce56cc795
MD5 8e202026cf4d6c587f3e8b909fd03097
SHA1 dff343baea43a9f025c56b6671182b59dfa1b56f
SHA512 6f03fcdb003db4e4425483266150c398db592acb77ebe6c5a115ed613eba8ff2f38e1dd31d20bf5f9d04a7891297e5b394d13d4c2260d092342c0de1116bfa28
SSDEEP 384:MDDLX7EXmoDf2MzY+t+MHewe8Fkrqq0uPw5JAQh5fRFk+98SWRLWxCW:Mz7smYu4Hp/eWq0OsiQhdR688VzW
TLSH
T15103289E72D044FCE866C134D6F68332D972FCA819B4166E1B54DA3A2F70E705B7930A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vontteSecurityHealthService.exe

Path C:\Users\Admin\AppData\Local\Temp\vontteSecurityHealthService.exe
Size 78KB
SHA256 e9dbeca946ed1f037ea1c14ce8df09b635ce876c22cd4c1c8aaaed3bda085eee
MD5 603a3dfa921d1c6e585e9a435c823884
SHA1 2c98df63b69c35e3d8c3ee47c3ff40c2266e3179
SHA512 4c8268139a6a9e04c48e067757f3bbaae811fefd072492a7f30ec63d8ed1ff40a32d26c072553efb794ac3be809a4e3b098d6c0a21036f81ceb060a9f60e8b1b
SSDEEP 1536:HpfEKNCj6VoJl9Go5K7s4Nu3E70XFq3DgdyvH0m9CAmxFAntnouy8pO:HVZ/VGS7rN+EgVgDtB9UFAnVout
TLSH
T1AA73F183D28CAABEF01491796E6F38385A49C709739143A1F9D23BB74FA1947871931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-103-0x00007FF69F170000-0x00007FF69F182000-memory.dmp

Download

memory/2968-17-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/2968-19-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/2968-20-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/2968-24-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/2968-21-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/2968-18-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/3604-56-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4164-57-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4164-46-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4516-62-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4516-64-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4516-102-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4516-78-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4516-58-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4516-60-0x00007FF731BE0000-0x00007FF731BFA000-memory.dmp

Download

memory/4644-76-0x00007FF69F170000-0x00007FF69F182000-memory.dmp

Download

memory/5368-75-0x00007FF7197B0000-0x00007FF7197C2000-memory.dmp

Download

memory/5580-31-0x0000000005480000-0x000000000551C000-memory.dmp

Download

memory/5580-32-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Download

memory/5580-33-0x0000000007150000-0x00000000071E2000-memory.dmp

Download

memory/5580-34-0x00000000077B0000-0x0000000007D6A000-memory.dmp

Download

memory/5580-35-0x0000000007470000-0x00000000075D6000-memory.dmp

Download

memory/5580-36-0x00000000075F0000-0x00000000075FA000-memory.dmp

Download

memory/5580-37-0x0000000008620000-0x00000000087E2000-memory.dmp

Download

memory/5580-27-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5692-11-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-3-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-10-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-9-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-6-0x0000014BB1910000-0x0000014BB1932000-memory.dmp

Download

memory/5692-12-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-13-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-0-0x00007FFC682AF000-0x00007FFC682B0000-memory.dmp

Download

memory/5692-30-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-16-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-14-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-25-0x0000014BB1950000-0x0000014BB1962000-memory.dmp

Download

memory/5692-15-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-1-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-2-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/5692-22-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp

Download

memory/6024-88-0x00000208F4CC0000-0x00000208F4D72000-memory.dmp

Download

memory/6024-89-0x00000208F4D80000-0x00000208F4D8A000-memory.dmp

Download

memory/6024-87-0x00000208F4CA0000-0x00000208F4CBE000-memory.dmp

Download

memory/6036-81-0x00007FF69F170000-0x00007FF69F182000-memory.dmp

Download