58e9508e363895165bee8892c9fde2c1048d2e000c44fd4bc2be739a37adfb92 | Triage

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 05:04

Sharing

Report Analysis Logs

General

Target

XWorm V3.1 - Copy/Background.png
Size

17KB
MD5

a466fc11f42a6de40e050c9813947612
SHA1

81845f1a0a98f590d97670c19d0a762123a2a539
SHA256

5047dc90d705a1a50c325fc00b26d5290939c42d6aa727d09e8d21d0537cec85
SHA512

59e3349a9291abe96c663e2f63345ea13c79e9a8a716a9408e74526f05642f1a8d59cc5ae866287299a4aa4a4fb8385f509de0d2dab483ffa6859a6a29c24556
SSDEEP

192:lCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp:s2wDZijJE+w2QIfGR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 - Copy\Background.png"
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads