hxxps://www[.]upload[.]ee/files/16472471/XWorm_V5[.]6[.]rar[.]html

Analysis

max time kernel
481s
max time network
492s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/files/16472471/XWorm_V5.6.rar.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
440	msedge.exe
440	msedge.exe
868	identity_helper.exe
868	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3252	440	msedge.exe	80
PID 440 wrote to memory of 3252	440	msedge.exe	80
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4328	440	msedge.exe	82
PID 440 wrote to memory of 4944	440	msedge.exe	83
PID 440 wrote to memory of 4944	440	msedge.exe	83
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84
PID 440 wrote to memory of 2684	440	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16472471/XWorm_V5.6.rar.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe090d3cb8,0x7ffe090d3cc8,0x7ffe090d3cd8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13105829455076964992,12813621163341754153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4113e45804b7888f88ae2a78482d0951

SHA1
4c59bba45c65ba65aa920cbd4eb0d7ccf517a220

SHA256
174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db

SHA512
16355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e521eb4a4c2bbe4898150cf066ee0cb0

SHA1
c2b311b8b78c677b55a356b8274197fdcbae8ab5

SHA256
1f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3

SHA512
59e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
027bc20a5a9a188bf9a066a19b44ce43

SHA1
1af28c3e48f53ae54b6c90dacbf4ea4adf60f7df

SHA256
c2e35ebac7a04125e22c7452f80973cb20aa9ff1a032696681828fea6192bf26

SHA512
81385984f637d57e0c0531b941f6160b349211fb7160470fcb3fdf09850720222fe488dcb0143b4c001f10225a229c61fc9bb0ddcd295263ee95586d997f02f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a81093ddc24cc9523cfed5710462d463

SHA1
d821e1785ab444e137efcf5ca60b490dd63ef0c6

SHA256
03b9fe81c776fc7d5020808c075bc67473e50ae73ffac0469d36fcfa0102e65c

SHA512
03973982ffb80159fd61fc3fe77d68e4730eed482fc97ad8f6ff60b4c53543b7b6f14f9d2a82c5757b3fa25694b903190fe06970116dd11e20d214c008f5119b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4890be37ab499d3876f45c12b62efd6d

SHA1
818caa0c1d2f5d75bf62118db05f7c88da1487bf

SHA256
36e10296f38759568115806ee21985ed4e0e93c1c186010c9a541c3497e84596

SHA512
18d88c5f12ba7c2576407b5491d41e74d6bd898624b8f09703c02c14e2442a5e0ad8e8941c59424e6d5937fc09a308a22b45eb30896e0fe7407df199a7266e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a3bf31b4beb0f1fa21ba8f81adfc145

SHA1
3c7992c584e90f22151436fbdd6af630c7365710

SHA256
a7d34a212ad2475ce55a2127cfa069b93f59f5165b1621142b164170e15440c2

SHA512
7175bfeac2f1b4e9b5571a0035bf463cd2070b1e2c12752afeb05a53d3639948c678b224b2c7d0ad17ef4b9fb9b8cd96db84944562cc2bf08e4374e6b185657f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d8013d030a05983b9087f52b0108d5f1

SHA1
4f5bc29af8af3e55a7a4d2013cee68ee295c0fdf

SHA256
9ed5c832b632133768f0648c76da7eb3e518a22198bda713b62c95861611c9f7

SHA512
dcc307e19dd172a0c5bdd6c4e78b05d7a921b49fa144a554f311d259671129bdfd27d34db44d2f056af17d13860e1977e805072475a6b200bb0d6fc95be9a33c

Download Submit