xworm | hxxps://cdn[.]discordapp[.]com/attachments/1226239279185920071/1226281254140510389/XWorm_v5[.]6_Edition_By_WantHacks[.]rar?ex=672e816a&is=672d2fea&hm=920c7506be69d3c5979796dc4f7d4cefd18a18ff3e0fc7923ac8ee2206d5c408&

Analysis

max time kernel
248s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1226239279185920071/1226281254140510389/XWorm_v5.6_Edition_By_WantHacks.rar?ex=672e816a&is=672d2fea&hm=920c7506be69d3c5979796dc4f7d4cefd18a18ff3e0fc7923ac8ee2206d5c408&

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

bCIPMuXfvOSef1Ru

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d67-427.dat	family_xworm
behavioral1/files/0x0007000000023d6e-437.dat	family_xworm
behavioral1/files/0x0007000000023d6e-441.dat	family_xworm
behavioral1/memory/1620-443-0x0000000000A60000-0x0000000000A74000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
3304	Xworm V5.6.exe
1620	XClient.exe
4852	XClient.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\NodeSlot = "6"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 8c003100000000006759dab2100058574f524d567e312e3645440000700009000400efbe675998b26759dab22e0000006d3b020000000d0000000000000000000000000000006e43ea00580057006f0072006d002000760035002e0036002000450064006900740069006f006e002000420079002000570061006e0074004800610063006b00730000001c000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "7"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 50003100000000006f582f92100049636f6e73003c0009000400efbe6759dab26759dab22e00000090da010000000600000000000000000000000000000042d72f01490063006f006e007300000014000000	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 9c003100000000006759dab2100058574f524d567e312e3645440000800009000400efbe6759dab26759dab22e0000000b0700000000040000000000000000000000000000006e43ea00580057006f0072006d002000760035002e0036002000450064006900740069006f006e00200043007200610063006b00650064002000420079002000570061006e0074004800610063006b00730000001c000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1300	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
1940	msedge.exe
1940	msedge.exe
2832	identity_helper.exe
2832	identity_helper.exe
3608	msedge.exe
3608	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3304	Xworm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeRestorePrivilege	4760	7zG.exe
Token: 35	4760	7zG.exe
Token: SeSecurityPrivilege	4760	7zG.exe
Token: SeSecurityPrivilege	4760	7zG.exe
Token: SeRestorePrivilege	400	7zG.exe
Token: 35	400	7zG.exe
Token: SeSecurityPrivilege	400	7zG.exe
Token: SeSecurityPrivilege	400	7zG.exe
Token: SeRestorePrivilege	940	7zG.exe
Token: 35	940	7zG.exe
Token: SeSecurityPrivilege	940	7zG.exe
Token: SeSecurityPrivilege	940	7zG.exe
Token: SeRestorePrivilege	2272	7zG.exe
Token: 35	2272	7zG.exe
Token: SeSecurityPrivilege	2272	7zG.exe
Token: SeSecurityPrivilege	2272	7zG.exe
Token: 33	892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	892	AUDIODG.EXE
Token: SeDebugPrivilege	1620	XClient.exe
Token: SeDebugPrivilege	4852	XClient.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
4760	7zG.exe
400	7zG.exe
940	7zG.exe
2272	7zG.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
3304	Xworm V5.6.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe
3304	Xworm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4016	1940	msedge.exe	83
PID 1940 wrote to memory of 4016	1940	msedge.exe	83
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 1468	1940	msedge.exe	84
PID 1940 wrote to memory of 4924	1940	msedge.exe	85
PID 1940 wrote to memory of 4924	1940	msedge.exe	85
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86
PID 1940 wrote to memory of 4444	1940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1226239279185920071/1226281254140510389/XWorm_v5.6_Edition_By_WantHacks.rar?ex=672e816a&is=672d2fea&hm=920c7506be69d3c5979796dc4f7d4cefd18a18ff3e0fc7923ac8ee2206d5c408&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3ec546f8,0x7ffc3ec54708,0x7ffc3ec54718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6031871999734163566,14000006816656471591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3460

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\" -ad -an -ai#7zMap27929:124:7zEvent25217
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\" -ad -an -ai#7zMap23615:268:7zEvent23161
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:400

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1300

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\" -an -ai#7zMap1469:268:7zEvent15640
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:940

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\" -ad -an -ai#7zMap7225:268:7zEvent2430
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Xworm V5.6.exe
"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Xworm V5.6.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qfcdxxaf\qfcdxxaf.cmdline"
  2⤵
  PID:748
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE437.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc921CD54EB9CF4B209D1B95BD52D26093.TMP"
    3⤵
    PID:3928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe
"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe
"C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3736c992856190e0278f109b705680d7

SHA1
e74b04862424bd845bdf75737b98754f3c529546

SHA256
a1c2e0000161d7586ead5d649d60a8918fcac5a6fc20569e38d20443a60a500b

SHA512
fbaa67ffeb1465958183f2e962f311a7830fadd071c9ecb6deac8c76e830ee72cd61ec997bfa3796c665696eea78f92a1cbad4948ab9fbd2ad14d949337dc72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36c5c7d35f35aebf0e561fadeea3e7b4

SHA1
905e620648e8ce4e656d94920c14dcfc123ba2f5

SHA256
58df4ec189e2c9492f07aface32f94923e1acc6934906c749781f054c38ada51

SHA512
a518bf3b0b590ca962b130214cc2e4ae1b4f716a791aa5f565876338f29084db5c6b0bc71a00982747508da8ea8ea63c6af96be568bececa00c9bbb203267b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2a0e00ec2c446b71e466a98744b4063

SHA1
df1dccc118cc99e11234cf1df966f9f82e872fee

SHA256
de7a994822e7c6149caabe27acae908c0ff5dc1be38b7bb3dba1cfe288a86769

SHA512
603b1293bbf519eeb079afb3f10bfb9f5cf6cecf4a30dd2fccdc146aefea09db8fa4cb363f3f90fd596870f910d583da814fe9c741fd3a726120315b19ac9255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec3f69ef-2df3-490d-b609-955e2c142539.tmp

Filesize
10KB

MD5
90c48b6bd04abc315b5f579c7c998c5b

SHA1
8226f493363f48453477f7afb07e3a5c384f316c

SHA256
77cc08d0f78528c21ba2eb016cda8aa7b348e63dc98ebc1b1250a720393a28d1

SHA512
c1c0abf701d2fea6a50bb16223bc433e7a42957494fa17caa9c8854bb19eb4ecbabec2c677082b633a6c23c8e4486f351e38dcbd5184c0be1bfb0d2fe0637729

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE437.tmp

Filesize
2KB

MD5
f70a5204178396aa3f76b5f9f97805ac

SHA1
b5f08ef387050cb70ccd2735cdee89f41bdae786

SHA256
70975a440de0fbdbe041de5c1c1f3c3a270fd670d601bc24c1b8db4c8bc22f34

SHA512
a826142ead4c061443aa6ed38d67d36eca3dbc6c32d14931f0ca204936c0f7021600c0141b694a22c82e00135ad3a26cbe213696bbdc2ef806c9fa820deb11b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfcdxxaf\qfcdxxaf.0.vb

Filesize
78KB

MD5
50ae5005795aa30bbd6def6a3874212d

SHA1
ce21e4561ea318ed4543b94b080c7defe6f7a8d7

SHA256
1ce64e438a467e854f30dbd2671d77725f8c0e6d01f3033a6435e6aff7a9099a

SHA512
c3848d4843bdf771c32bb420a083bb6885c3f8d551ae18cd8f96b5cb7d295399fcb6f73513ff835d65e0478da49a6c034aaa1af29ca14a3669acd49d4a7fe164

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfcdxxaf\qfcdxxaf.cmdline

Filesize
436B

MD5
e9306b97d3f066d95053d66867892229

SHA1
24221127f0643512348fbc5d72aedafaee837e93

SHA256
e2989acb760b1942c7e085107dd060b09fd531122dee701d0527a55ae55c8a9c

SHA512
94f5e920402307a864ddc68b6ac1feeb8f4d53c8446f3a33c3f1326ce79cbc0441bc3ca0b02125f9b38ae23271ad9448bce261f2679055e2496f1828a92ce837

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc921CD54EB9CF4B209D1B95BD52D26093.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 130324.crdownload

Filesize
22.1MB

MD5
083de95e4f0cbf8b339190d0cbda34e7

SHA1
9fe02f557c98a2b624193f10894785370f6e531f

SHA256
966ddc2d8c5b662e64e17b68028a7adae4b7daf507c4fbeb51ab265bb767ae86

SHA512
01d75ebc0ef0a6490bfba23c421dd7076e17315ffb916a04d496368800b7e3ae5c2c7033c898a277b0402b19d3807c20094a0f2ebd1371daad67d95fe3e51e4d

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\ReadMe.txt

Filesize
1KB

MD5
21ac00a7494c418dfe31419c69897f56

SHA1
6b1e523272a283f3b279c8bfe8b180fed6289586

SHA256
c065ac9d59d09966553b2366ac8a0bb03f42513bb318df3e9867a84930b459b3

SHA512
c7ae401c4b68d5b5c9d0c3a23bdbb8e6c4461337a12c14239ace639dd9fdce4b31684dfaec8b4bf9d5f704a03102db2554aafb73ca64c8c9e82bcafaf496adee

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks.rar

Filesize
22.1MB

MD5
9a05cb40cf6e1464fc85ebd4e28950c3

SHA1
aba58887b4eb9b653b14a8d2e80620209838bfb3

SHA256
839c10151556f2c2bf27989bc262b9276b03b0567b8e16dcf0198ebc891c54a5

SHA512
8254c10f53b7eabfb8310308bed6a32554f3a026560cc30edef1828dcf68560a75f5dc86a3c5729b45071abd4eda91f8d9502973a2621b0626f30633407c1485

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Plugins\ReadME.txt

Filesize
30KB

MD5
8e95717f17455f118e91bc5f00796a87

SHA1
5165f7b6897d7824fc312eb1f89da3633ead4273

SHA256
fd48451771d1b0570457d12e2912b48672d484a42caf02fc9b2c0a8e32b5b6c3

SHA512
f91ca87ee748d49ae64d4e409b9dc9fe314f1da7604bd54401914b0c0b3b7469a6d2034e043ac857a3d0e73c2ca9a171bed276bcbbd1c06f109dfb6dac2b3288

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Plugins\Stealer.dll

Filesize
3.3MB

MD5
ade4edd66bc695c9465816fa2538d0cb

SHA1
e4351a2531307c848c60b20ffb50bcc04156fdbc

SHA256
018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf

SHA512
e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe

Filesize
32KB

MD5
58f00fd917e6bf44ad441d5078c5b165

SHA1
5a81dda7e7e8438f0e074f9b15a256437fe6f3e0

SHA256
c52a1919d5cfefed745d0b146625cdbe436c822d4bfe8bee0c46285b8a8d5a7c

SHA512
b4ddb2f05d362c817ee91bbc947c794a6c4b2172fd4a2684f98f8703911b872be1a269c708c69647e24de568fc2b87ca9402abc683c3bca0ac0b31752b35099b

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XClient.exe

Filesize
58KB

MD5
c952b55da6fd2282cb7cc27e1542ac05

SHA1
e8d49b5322dae1d229a291661fcfc93db804f8b6

SHA256
0e8a51fa71641ba8392637215e8b91fdddc1cad71314b336882a73f42feddea0

SHA512
22bb049ba259825807c267e90b93f6c5acced50f0e1dbb94677cfd1ec4b2239c26fb8888652ff0adf8c114e2c389a41b217b5ebe222c1b4096159b006327ef50

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Xworm V5.6.exe

Filesize
24.7MB

MD5
d626f885874892781aa6efcc7e0c2a69

SHA1
09f2aeab8f4618f26471261a746bad43bfc917ff

SHA256
df512cabbda87f7630eaa05abce3b84698a00a36d41222a95649f851d3317a1f

SHA512
26695528d81a1cf737d9337f11ca29fcbb7defb0418002e955501d7048c597cf23330be7bc49d33eceead020eb3a3e752d6a6c048ee54aa23c9e1981a520aa63

Download Submit
C:\Users\Admin\Downloads\XWorm_v5.6_Edition_By_WantHacks\XWorm v5.6 Edition By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\XWorm v5.6 Edition Cracked By WantHacks\Xworm V5.6.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
memory/1620-443-0x0000000000A60000-0x0000000000A74000-memory.dmp

Filesize
80KB

Download
memory/3304-414-0x00000297FFF00000-0x00000297FFF82000-memory.dmp

Filesize
520KB

Download
memory/3304-409-0x00000297FD600000-0x00000297FEEB8000-memory.dmp

Filesize
24.7MB

Download
memory/3304-411-0x0000029800200000-0x00000298003F4000-memory.dmp

Filesize
2.0MB

Download
memory/3304-412-0x000002979A950000-0x000002979B578000-memory.dmp

Filesize
12.2MB

Download
memory/3304-439-0x0000029800570000-0x00000298006D8000-memory.dmp

Filesize
1.4MB

Download
memory/3304-418-0x00000297FF770000-0x00000297FF79C000-memory.dmp

Filesize
176KB

Download
memory/3304-416-0x0000029800000000-0x00000298000B2000-memory.dmp

Filesize
712KB

Download
memory/3304-420-0x00000298006F0000-0x00000298009D2000-memory.dmp

Filesize
2.9MB

Download