Overview

overview

10

Static

static

10

Microsoft Edge.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Microsoft Edge.exe

  • Size

    204KB

  • Sample

    240525-ec1bpsdf43

  • MD5

    2f8eec53d54849f91c554d3f60312a72

  • SHA1

    c75e269e347f6773eb3261408a24165f6e4d004e

  • SHA256

    4aa25bafef5dc68516ade8745ae9fd6a3b6afe94585bcc8ade397a0f465efe69

  • SHA512

    c711f0425224971128844fa570f510102b1b5e818c57bc71a5f6c49a52b266b122781886b2f3050b4172a755379726062f822aaaf7c452d0d1fcc005805109aa

  • SSDEEP

    3072:K6TnncjjDb+bQkJLkkOJOebvGRUGKXs+S++7KFSbxeY+qDDrMP:XcHDyb51kjbvPGqStKEbxI

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1488

Attributes
  • Install_directory

    %AppData%

  • install_file

    Microsoft Edge.exe

Targets

    • Target

      Microsoft Edge.exe

    • Size

      204KB

    • MD5

      2f8eec53d54849f91c554d3f60312a72

    • SHA1

      c75e269e347f6773eb3261408a24165f6e4d004e

    • SHA256

      4aa25bafef5dc68516ade8745ae9fd6a3b6afe94585bcc8ade397a0f465efe69

    • SHA512

      c711f0425224971128844fa570f510102b1b5e818c57bc71a5f6c49a52b266b122781886b2f3050b4172a755379726062f822aaaf7c452d0d1fcc005805109aa

    • SSDEEP

      3072:K6TnncjjDb+bQkJLkkOJOebvGRUGKXs+S++7KFSbxeY+qDDrMP:XcHDyb51kjbvPGqStKEbxI

    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks