xworm | 070a0a68e763ddee2edac3592a2743dd6c5159f3334118d62873e9302e5b2501

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 06:50

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Marz Paid.exe
Size

912KB
MD5

0d05a6bb4a07037e844e3b252b5f8bc1
SHA1

b9d6fa8dd4b81ba6774cd8207c786556f632232e
SHA256

070a0a68e763ddee2edac3592a2743dd6c5159f3334118d62873e9302e5b2501
SHA512

140b9417b7f7c8a32c75f179600994b4e06437bf2a333954e1d6dd2660572ef9ba4264c247ffdadea8a037557774ffd63b98106ffc406d64fb6861b143d50e1c
SSDEEP

24576:H5ZWs+OZVEWry8ApButPfhQfvUF9ZTkYlE5xPQZAKyv6Y:ZZB1G8Eqfh5F9ZflChQgv6Y

Score

10^/10

xworm execution persistence phishing rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

might-hk.gl.at.ply.gg:42295

Mutex

07x0yTqR2FSkwbSm

Attributes

Install_directory
%ProgramData%
install_file
systemprocess.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\RarSFX0\extrahelper.exe family_xworm
behavioral2/memory/4272-15-0x00000000005C0000-0x00000000005D0000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1416 powershell.exe
4676 powershell.exe
2148 powershell.exe
464 powershell.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\extrahelper.exe	family_xworm
behavioral2/memory/4272-15-0x00000000005C0000-0x00000000005D0000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Marz Paid.exeextrahelper.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Marz Paid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	extrahelper.exe

Drops startup file 2 IoCs

Processes:

extrahelper.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	extrahelper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemprocess.lnk	extrahelper.exe

Executes dropped EXE 2 IoCs

Processes:

extrahelper.exemenureel.exe

pid process

4272 extrahelper.exe
1488 menureel.exe
Loads dropped DLL 2 IoCs

Processes:

menureel.exe

pid process

1488 menureel.exe
1488 menureel.exe

pid	process
4272	extrahelper.exe
1488	menureel.exe

pid	process
1488	menureel.exe
1488	menureel.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

extrahelper.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemprocess = "C:\\ProgramData\\systemprocess.exe"	extrahelper.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 ip-api.com
78 wtfismyip.com
79 wtfismyip.com
Detected phishing page
phishing
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
26	ip-api.com
78	wtfismyip.com
79	wtfismyip.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeextrahelper.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1416	powershell.exe
1416	powershell.exe
4676	powershell.exe
4676	powershell.exe
4676	powershell.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
464	powershell.exe
464	powershell.exe
4272	extrahelper.exe
3476	msedge.exe
3476	msedge.exe
5004	msedge.exe
5004	msedge.exe
2772	identity_helper.exe
2772	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe
5004 msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

extrahelper.exemenureel.exepowershell.exepowershell.exepowershell.exepowershell.exeAUDIODG.EXEshutdown.exe

description	pid	process
Token: SeDebugPrivilege	4272	extrahelper.exe
Token: SeDebugPrivilege	1488	menureel.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	4272	extrahelper.exe
Token: 33	3432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3432	AUDIODG.EXE
Token: SeShutdownPrivilege	6012	shutdown.exe
Token: SeRemoteShutdownPrivilege	6012	shutdown.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

extrahelper.exeLogonUI.exe

pid process

4272 extrahelper.exe
6088 LogonUI.exe

pid	process
4272	extrahelper.exe
6088	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Marz Paid.execmd.exeextrahelper.exemsedge.exe

description	pid	process	target process
PID 32 wrote to memory of 4376	32	Marz Paid.exe	cmd.exe
PID 32 wrote to memory of 4376	32	Marz Paid.exe	cmd.exe
PID 4376 wrote to memory of 4272	4376	cmd.exe	extrahelper.exe
PID 4376 wrote to memory of 4272	4376	cmd.exe	extrahelper.exe
PID 4376 wrote to memory of 1488	4376	cmd.exe	menureel.exe
PID 4376 wrote to memory of 1488	4376	cmd.exe	menureel.exe
PID 4376 wrote to memory of 1488	4376	cmd.exe	menureel.exe
PID 4272 wrote to memory of 1416	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 1416	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 4676	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 4676	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 2148	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 2148	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 464	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 464	4272	extrahelper.exe	powershell.exe
PID 4272 wrote to memory of 5004	4272	extrahelper.exe	msedge.exe
PID 4272 wrote to memory of 5004	4272	extrahelper.exe	msedge.exe
PID 5004 wrote to memory of 4176	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 4176	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 536	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 3476	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 3476	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 4860	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 4860	5004	msedge.exe	msedge.exe
PID 5004 wrote to memory of 4860	5004	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Marz Paid.exe
"C:\Users\Admin\AppData\Local\Temp\Marz Paid.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:32

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start "" "extrahelper.exe" & start "" "menureel.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\RarSFX0\extrahelper.exe
"extrahelper.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\extrahelper.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'extrahelper.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\systemprocess.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fbi.bet/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc39d846f8,0x7ffc39d84708,0x7ffc39d84718
5⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
5⤵
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
5⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
5⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
5⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
5⤵
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 /prefetch:8
5⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
5⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
5⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
5⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
5⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17492305455404750022,1557229143437714592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
5⤵
PID:1164

C:\Windows\SYSTEM32\shutdown.exe
shutdown.exe /f /s /t 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Users\Admin\AppData\Local\Temp\RarSFX0\menureel.exe
"menureel.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3935855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6088

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
1024KB

MD5
214b2fa780663e5b1778c56a8c0c63fd

SHA1
2a82b012c67b9f595eb9d236514bdc5fd69f99e1

SHA256
916ba93a76b04c7ba7dd845ba5df93b495016834581ea315af3b99207251cf47

SHA512
6d1b74be3c6db291094fd464f4a6e9495e5d88eae0ab98cd94c27c2d201cc002c5dbac312157693ffb97504b14b1137f6faece68e5bce762a215d58466555ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
f521d2c7aa82cc5f7217691e53ded554

SHA1
e5b2850f96b36b6f607837f70f6f68ffb2dc16d8

SHA256
9e8c5ba387956c1d5b1a6f05f780d20b71ea664f572de69259473c95aece74b8

SHA512
307daa38bb93bd0749c09400af14147955893a1212b6513cd5844b7901259056175e1d17237680c54d6c1fb081fa46bff9fe9c8abffa1bc74a807a5ba1492f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
397B

MD5
f2c43c2545acfe51b5831745132afbe3

SHA1
a2cd62feae3ebb954e7e11d7ae0edd765270fb96

SHA256
e87c11541968dcac3ee47f93e155cfc864bca6ebc04b141796f0e7e6fda2d54b

SHA512
4aace24fcda92eea80ed27f97a9005e4d6ac5202c9df85b13228538dbf77804b8fe5cea36b7131854356366a52b4c9ba57263695be9981bca7bde14e4950c674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
80bfeeb82b2ccc6548e223f0933c1957

SHA1
a6f3eafb24aab20dadd37163057e1bd219e8014f

SHA256
3ae33c5b01196662ad4e966f966738bbd8602d86b201241297d695ac3443c545

SHA512
f5401f44c5b73154ff1e23279056cd19bc45697d1358bb059525430053cb7950abff5db7d8c236491c68dc0e5cf71dd1132a09569fcdab6038c5c479868e2e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
306d3570e70358dd5d7cc6dfea4d4b44

SHA1
455bf4aeabb120c9d4af7d6bef03eb858eaba3e9

SHA256
192de9684e6ddfcd3adf2975a6e097eba55d3256f0178301ad855d031ff828a7

SHA512
28959e80a0a9ebe82f1de0465ec5eb4c56ab7552df340547236feefba01091aee17c5b522f278538744d5421136524ac2af04435dd76efe99f1b1c5f2913655c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bed6616f301223fce3f35fc6b7443a3d

SHA1
83249ffea5129614f8da12b65ce075a1f2579d56

SHA256
dc32b87af1ef6a0eb64fdaf3ac02e8738a1790070bf82ced474c7a7734a7b985

SHA512
ddb3267ba6ea3394075e8f25a02c9ae0999964c42c7f6be776bec3d63889c4dc3464175b654eff902db3d439a95df7e0b3f2d92224274d36c56d572685bd4a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9f565d68a806308f644160150df666ef

SHA1
6deeacd9eb329994d15718d59c8aa7fc15418df5

SHA256
e9ba560b5d4c75622b56bd2d7f4e5a873407fc8f7588f5e6795ea603988acea0

SHA512
b23da9d8a7a66ff241d0867533fe5d858ca981cac2dfa86ebfd1bf2d89b823dff84fa00003a1917da5fb651cf8b4aaedcc5e494097f9f325d4049a09c3e97308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d63d42024ad3acf9c241c118dc3c2d6b

SHA1
a9dbbb7c2198c0157597c51e6a9a89ab4acdf7ee

SHA256
a97e2386949ae0e3b0ebf5b000574ec2208106e311f0ed7573d55edeb69d3633

SHA512
421201707890ffc973d6b810cd26bf9b1cbdba9efd39b6533d6d1e8cad86e3303c71cbfee752a931ef4acba422db4a9d548ae4b28bea021f2f7757ba013adf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
c1b0a9f26c3e1786191e94e419f1fbf9

SHA1
7f3492f4ec2d93e164f43fe2606b53edcffd8926

SHA256
796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

SHA512
fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Newtonsoft.Json.dll
Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\extrahelper.exe
Filesize
40KB

MD5
0154ccdb9695852a8eb2579db532ac26

SHA1
2269d2bc4fbd18b87fb11ade9a1255682645ddc8

SHA256
69eae309988e1b44c2e29fcafac1a12ef5eb51641b6368116e3f387fb0199f1f

SHA512
069002041960f30c07e5a01e0495993230ae074f872a72bdf62f3c3213aeadadaa14997bae1aab696e5918429e6c21211882a282b254bcef75b54ac262c29f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\menureel.exe
Filesize
664KB

MD5
adc626342cf83432c5dd929a985632ff

SHA1
eb56af049e2a835657b2f7d9a187dedaba33d83c

SHA256
fe6ddcf651da72be42ec853775520073703174bfab4cb7e87a84472226c0ad6b

SHA512
1bb5e3d2c01a986e77c16d3e964eaa477d5d921f736fe084f0ec4c295e964afabde4ddcca1cea8f1dce19261012278b0260ec596f65552617b7f828bcff5c8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amk4ed4j.5nd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_5004_UDARRSFCPNXLFIDP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1416-31-0x000002717DF70000-0x000002717DF92000-memory.dmp

Filesize
136KB

Download
memory/1488-25-0x0000000007F60000-0x0000000008012000-memory.dmp

Filesize
712KB

Download
memory/1488-18-0x0000000005290000-0x0000000005834000-memory.dmp

Filesize
5.6MB

Download
memory/1488-29-0x0000000008510000-0x000000000854C000-memory.dmp

Filesize
240KB

Download
memory/1488-16-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/1488-26-0x0000000008120000-0x0000000008142000-memory.dmp

Filesize
136KB

Download
memory/1488-82-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/1488-17-0x0000000000470000-0x000000000051C000-memory.dmp

Filesize
688KB

Download
memory/1488-27-0x0000000008150000-0x00000000084A4000-memory.dmp

Filesize
3.3MB

Download
memory/1488-21-0x0000000007940000-0x0000000007952000-memory.dmp

Filesize
72KB

Download
memory/1488-20-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Filesize
40KB

Download
memory/1488-19-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/4272-30-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

Filesize
64KB

Download
memory/4272-81-0x00007FFC3CFE3000-0x00007FFC3CFE5000-memory.dmp

Filesize
8KB

Download
memory/4272-186-0x000000001CB70000-0x000000001CBFE000-memory.dmp

Filesize
568KB

Download
memory/4272-85-0x0000000001020000-0x000000000102C000-memory.dmp

Filesize
48KB

Download
memory/4272-15-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/4272-13-0x00007FFC3CFE3000-0x00007FFC3CFE5000-memory.dmp

Filesize
8KB

Download
memory/4272-84-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads