4882c9869db88272d7cf824af2ed090c37dd6c0e1ca51c0eafbcacdf3542fb88

Analysis

max time kernel
1690s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20240730-de
resource tags

arch:x64arch:x86image:win10v2004-20240730-delocale:de-deos:windows10-2004-x64systemwindows
submitted
02/08/2024, 05:17

Target

XWorm-5.6-main/README.md
Size

981B
MD5

f5ba92955efe3119624dd8599f3c2220
SHA1

12208614f0c6235f222521d80f387ffcc14399f1
SHA256

d42574b91e2266755cc594bc657c38cb7fdf897649db11da3878d581e88cb62a
SHA512

28ed8b46e9eac1d93795db10ac819bec12ddec87b3fb7c7908d1fb9fb8fe260a587472c721b6121948b1102df7ec403f4202c9eafbde7d6fd6e23fbe72fd571a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\README.md
1⤵
- Modifies registry class
PID:1452

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact