Extracted

• • Target

    triage.exe

  • Size

    37KB

  • MD5

    c9c211b4a379c2eeb89cbdfc7ba68df4

  • SHA1

    c9ab5d91354d53a34a693af91af4b765d2c8cb83

  • SHA256

    63fcbd965122c086c9ceee273cffb44b881ac1b785545a164c8bdbd6e8c4728b

  • SHA512

    84a2867005c6237d92c666ecd2e58d04a785236009262e420a5665751daf780ff83dd370b995c633c5a1d15af4dd04d948a4527eea524b635c2f273103a90185

  • SSDEEP

    768:apCGdNwd0oDLw4/kLh0nbn1tTr+mKLLFyG9fc3Ojh9D7:aptNvoJkwt3+7Fz9fc3Oj3

  Score

  10^/10

  xwormpersistencerattrojanransomware

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2