Overview

overview

10

Static

static

10

XWorm-v5.6...ed.rar

windows10-2004-x64

3

XWorm-v5.6...ed.rar

windows11-21h2-x64

3

Analysis

  • max time kernel
    1794s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2024 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm-v5.6-Lifetime-Editon-Cracked.rar

  • Size

    24.4MB

  • MD5

    35c2352086d632af8df2b06aa235aa65

  • SHA1

    5363bccd0bd9e0626904d0c8cdfbee09f9453e22

  • SHA256

    4c7d6cf21cefb460a9c8cf9860b3a4baf11505c876e60b247e5b6ea85b46e8cb

  • SHA512

    27da56db40ccd254ec19552fb618ad2b72bbb2c5dc887cdab693a0daeabd9cc20415604e359dc7d25e61f0d1389e72b3b573febd989c2fc657defd4b40905be0

  • SSDEEP

    786432:wyWY0S5vBTkNPurr3hEWBsrV8bncwApLD:e+jk0rr3hFBU6bcwMP

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\XWorm-v5.6-Lifetime-Editon-Cracked.rar
    1⤵
    • Modifies registry class
    PID:1476
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3380
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
    1⤵
      PID:4928
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:228
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1400,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
        1⤵
          PID:3112

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads