Extracted

Extracted

• • Target

    XClient.exe

  • Size

    62KB

  • MD5

    0ec8fc74616f174746cb50e46d08d73a

  • SHA1

    082c2fee8f1f1404b5299083428cf7fd769076a5

  • SHA256

    2b105bc9141fb923b548a761f733a0bbd5ba732d317c83287a2daf091fac9f7e

  • SHA512

    d499b24adcca2401e966b03d3369506b7ff534117aff65cdb070ab6cc3dc11abc653fb511eae52c6dfa742eb75ea592695e2b62f3b26f53d839c945ba206e05d

  • SSDEEP

    1536:rc7XNZ0lMLslvRXTFyPIBbP+Q+GGI6jyIO+tb:kQGslvR9bP+Q+GqyIO+tb

  Score

  10^/10

  wannacryxwormdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealertrojanwormevasion

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2