7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27

Analysis

max time kernel
110s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm-5.6-main/Plugins/Clipboard.dll
Size

14KB
MD5

831eb0de839fc13de0abab64fe1e06e7
SHA1

53aad63a8b6fc9e35c814c55be9992abc92a1b54
SHA256

e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
SHA512

2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
SSDEEP

192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
69	camo.githubusercontent.com
70	camo.githubusercontent.com
71	camo.githubusercontent.com
72	camo.githubusercontent.com
73	camo.githubusercontent.com
74	camo.githubusercontent.com
68	camo.githubusercontent.com

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

117 ipinfo.io
128 ipinfo.io
135 ipinfo.io
116 ipinfo.io
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
117	ipinfo.io
128	ipinfo.io
135	ipinfo.io
116	ipinfo.io

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5620	5504	WerFault.exe	XWorm V5.2 Resou‮nls..scr
5776	5576	WerFault.exe	XWorm V5.2 Resou‮nls..scr
3860	6008	WerFault.exe	XWorm V5.2 Resou‮nls..scr

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

XWorm V5.2 Resou‮nls..scrXWorm V5.2 Resou‮nls..scrXWorm V5.2 Resou‮nls..scr

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{EA818B77-37CB-4F7B-815E-2EA50CFD13A3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3160	msedge.exe
3160	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe
3604	msedge.exe
3604	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

XWorm V5.2 Resou‮nls..scrXWorm V5.2 Resou‮nls..scrXWorm V5.2 Resou‮nls..scr

description	pid	process
Token: SeDebugPrivilege	5504	XWorm V5.2 Resou‮nls..scr
Token: SeDebugPrivilege	5576	XWorm V5.2 Resou‮nls..scr
Token: SeDebugPrivilege	6008	XWorm V5.2 Resou‮nls..scr

Suspicious use of FindShellTrayWindow 41 IoCs

Processes:

msedge.exe

pid	process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4856 wrote to memory of 3608	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3608	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3452	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3160	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 3160	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe
PID 4856 wrote to memory of 1328	4856	msedge.exe	msedge.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\Plugins\Clipboard.dll,#1
1⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9ef9046f8,0x7ff9ef904708,0x7ff9ef904718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16575473476437207417,9141304421894655625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:228

C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1984
  2⤵
  - Program crash
  PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5504 -ip 5504
1⤵
PID:5804

C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 1948
  2⤵
  - Program crash
  PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5576 -ip 5576
1⤵
PID:5968

C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XwormHvnc\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\Desktop\XWorm-V5.2-main\XWorm V5.2 SRC\XwormHvnc\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 2008
  2⤵
  - Program crash
  PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6008 -ip 6008
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
28e800e0b185e4570e26c698061c41ac

SHA1
1394d0cc0fd1e72ac511b8f3fc314e5cc7ad5b37

SHA256
a0712e3c3e2d13528f3e8b59082a15bec792b01ebb43836adae58fe40028e43e

SHA512
f74698821fcc7f44e9d869172d0024335b7054a8b66b7dd6bc5e452142d6fe481a1b4bc1a5321174073a6429f9c7dabe118aaa027ab4f39abfca694c54b41549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
daae521689c8df0e75c1c7b6fe6f8884

SHA1
d13ef8f7b347da7fa26594f53e97dbd429203332

SHA256
1c405a1be2658b5d93dcc3f9334de9b45323bf58c038a5b09ead6c72fbf84241

SHA512
0899b7357da44c583cb56d147440723da26c671586b96a52e6c483689899c80107ff9acac9492e9e15ec2b261042fc1281113bb5b215f8271c6e22f8469af006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58334a2d9b79247dc8644669c150f00b

SHA1
795b2d7c196e107e08eccbd9de69087a559cd5a8

SHA256
beb2bbe616b90f6e498daaa3765327864b11151a489344aa9073709d8627a3d9

SHA512
318abd2d9894c10d1a131facacff17c14d16940cd142c917640a6acec4d4329695951249a271b47ba867ce4ca01637b7c7e5d78065c2997bc94f5fd60f5acf8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
473f3efb4cdb5ae798b2edc37f82f9b8

SHA1
e88d4e3d6b757640a829ac78f095a1a75e38454c

SHA256
e71b204f17ac00397fd69f0f0c3a68a5bcf4b966a76968834836619637193291

SHA512
4ccb852f6dd7bd8e519c76937af144c0c85eb6d7e062cf2a75465da458b1f3029c74790c3764884b3ecd31302d8e49cfcace93f4cca67535d246ec9130107b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
07d2799741dddba8cb1e56468b5da4bf

SHA1
2a954f1895882e1c5f3ab3eed72dfc04fd0dcd97

SHA256
492e2653425c3996a0155f479f7020d68ff561340b41846a6303a0493e332f89

SHA512
3262472a40019b4639964c52fa5728b3d872986ed25320df9c0eba26d81e81f35826a1109fb6d38554a137b3865b7a19bf0c49af7574221e8be53dd82171a9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a5b97372cace4a935ff5da126e24365

SHA1
3386816730d1c6269213ce4e1ca2de728bb167cd

SHA256
c26a5c41382e94a59559f0e24b5482c3f570f93b11929dbb6eaee4987bf2937d

SHA512
10377b8625eec145efc7a0f9d4518887cf0bfb91c30293761d109e5a68788a8e8dba233bc641e2f453df040d65ae7ca8ec3f3c56bf3cb4d6ef40ec52e887138e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27ff4d99f40295a28af6be67dcd5ca2a

SHA1
1e9266d65be020d2bd5c8410e4c96a7dc50f3493

SHA256
10633d471c37203cdd2c8fabb34fdab6d9a495080d0b18a84b8655c4cbfe3d31

SHA512
0ebf375c22ecf4b400a5af608cf5afd6f3194c5d5739350d9c435a134c88772fec83dbdaffea2360b6b0a5acc6b17645e18af5f63b5236ec1c9b69b45f1815a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587923.TMP

Filesize
1KB

MD5
cd2da2394cdfef704f193122714c2e76

SHA1
59a40cf1f3e0e1486acf9f1feaef80afd969dbe0

SHA256
8630a4f5446b6266245a85182da014958dc93bbac9942fac745655d7ec5d6e8a

SHA512
b7ad9f1e932d7474e53a939f65f100725da9c96515560f982b282c80ff79d3bf0d5d57872b4e19e979961fc0a2e257c003ab84228560ea021a518f6eabf06d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d8a42615dd50908deaa0b60fd2d760a

SHA1
a621675d5c3711c9d672c489f7c7abf597cc0999

SHA256
bf127dd9cb5cfe171e81053314c99babece00d649e52eef81b8127d74872c534

SHA512
6589112803e7e85482ba086f12d1b4abbd31978c06fc7465f103b908bde03294479bde1635d73f4b4c6a86c6ef6aa2558f6c30cc62aba6b8fc9e756b208516e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b72f748bd5a24d72e7a73f6ce6add139

SHA1
6c7aaba46744eb48f3e834d9454e418282cc0a08

SHA256
7942a44783dc4ff25addccff2bd0f5c33978a2013d2db6fd2def10f8e58ced5c

SHA512
a63b06c5473ee1f90f81b73ca36c65061ea34af4be14c81d9bff5a6ded0a19dd5f84c3a430bfd6644839b5bbb2338f998a0c6699bb141e6e638b6666c9943dec

Download Submit
C:\Users\Admin\Downloads\XWorm-V5.2-main.zip

Filesize
752KB

MD5
86043c87e5d68053e6552b971f35b727

SHA1
eddb54740a4202812c53e765eaeced31375ae18a

SHA256
18797068b419b8c0c5a72b246c820e1bb8984166a2ef83552ebbd9429b4597fb

SHA512
cb7960fc7b4f7e1db7aabad7889e9d3c86bfded2eb6fb42991b5178a458b82a42a24a901ed89582d4001c426d4e7b143018df084297b2ede7b8ffce5308512c9

Download Submit
\??\pipe\LOCAL\crashpad_4856_FKKFOQHCHJWIGTAM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5504-387-0x0000000000780000-0x00000000007DA000-memory.dmp

Filesize
360KB

Download
memory/5504-388-0x0000000005120000-0x00000000051D2000-memory.dmp

Filesize
712KB

Download
memory/5504-389-0x0000000005250000-0x00000000052C6000-memory.dmp

Filesize
472KB

Download
memory/5504-390-0x0000000006480000-0x00000000064A2000-memory.dmp

Filesize
136KB

Download
memory/5504-391-0x00000000065D0000-0x00000000065EE000-memory.dmp

Filesize
120KB

Download