xworm | hxxps://github[.]com/Crysiz2631/XWorm-3[.]1

Analysis

max time kernel
101s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Crysiz2631/XWorm-3.1

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

full-wet.at.ply.gg:38848

Attributes

Install_directory
%AppData%
install_file
chrome.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023dbe-376.dat	family_xworm
behavioral1/memory/1352-385-0x0000000000E50000-0x0000000000E68000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
4960	powershell.exe
3824	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	XWorm V3.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2660	XWorm V3.1.exe
1360	XWorm V3.1.exe
1352	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
4244	msedge.exe
4244	msedge.exe
60	identity_helper.exe
60	identity_helper.exe
4456	msedge.exe
4456	msedge.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
3824	powershell.exe
3824	powershell.exe
3824	powershell.exe
1352	svchost.exe
1352	svchost.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1360	XWorm V3.1.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe
1352	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	5080	7zG.exe
Token: 35	5080	7zG.exe
Token: SeSecurityPrivilege	5080	7zG.exe
Token: SeSecurityPrivilege	5080	7zG.exe
Token: SeDebugPrivilege	1352	svchost.exe
Token: SeDebugPrivilege	1360	XWorm V3.1.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	1352	svchost.exe
Token: 33	3988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3988	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
1360	XWorm V3.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4444	4244	msedge.exe	83
PID 4244 wrote to memory of 4444	4244	msedge.exe	83
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 844	4244	msedge.exe	85
PID 4244 wrote to memory of 2140	4244	msedge.exe	86
PID 4244 wrote to memory of 2140	4244	msedge.exe	86
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87
PID 4244 wrote to memory of 1992	4244	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Crysiz2631/XWorm-3.1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf7a146f8,0x7ffbf7a14708,0x7ffbf7a14718
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,14270585579932784755,100590769612076669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2428

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm-3.1-main\" -ad -an -ai#7zMap6407:90:7zEvent22934
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe
"C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2660
- C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe
  "C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  PID:1360
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\Readme.txt
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V3.1.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
82b3d01e849168afec022d69dbf2fe11

SHA1
9438a31c10ee617a8d6df151296c8a0fa6f2619d

SHA256
26d0b6fb4d77ee02f7a7e64058398dc5257b8097a49ae2d1d7707dd8c81d19ad

SHA512
1534d685c5e493951c687235bf02b40d3d06303ce81a35c6b6858cd5fd479023ca4ece1dcc2f753c5b5ec48bc2546d7fe475ec63680d64243d053aebd9367813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
50e64b41ddbd439beb3cc59b19a36a83

SHA1
dbc9002a5879fb70372d4e969799882ba6aa76af

SHA256
27a2f567ea2bdb5f4e53c1315fb56b7852197e300cc3383972931a3951b5cfa1

SHA512
397544246da42a9ee8858535fa5173cdf92a63855729f22280442cacab1e0b179162db04c7a1c35f5bc73e8005ca0cd6f0c20c62e57b9f9e0149f885894f6615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b514db18c8016ec5eb549d9b5dfd3672

SHA1
36c0b6275b0d76c2f4dc66bee1421556148a32c3

SHA256
567f75f9ab4a4a463bfa5a160e58bf468d68a9d0435702689fd9502f6af032ae

SHA512
47c122597a251c8386a07564fe09f3d5565911e1ebbcae01afcd5e679cad31afb1b0b12f7dd14e3ff8db53ee2b444242750767c94516a280b16701d85e106e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f028148369d9f7aea5c1afbfa6bec055

SHA1
2b34269abd8d63c93324c7a4aed3f7bc658648e1

SHA256
cc1845f64a504d215f94cfe2241578944ebc3a875b2115ea2c0e6017be447b24

SHA512
f589da7216ccde4321255e58e17c32f5d0683047f9c0368985ce49ceccde843ec9db3f21eecbe76d9d21cc4d99d11d9c45c53d80c22008e87ce3d9b1b7c3d1ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd32cb6f21cdf2d486a5a5900e9427e6

SHA1
2faa5de1ffee8128efe0484a0afc41a688320a68

SHA256
97600c4735d7fddb7d05fa51c72d6210c3c7dc334aa9ecff4cfb927ecb59cedd

SHA512
9c80dc3f55507bd6881b4c2167e5ffe162fb90ad4e3a5f36525d822cc93250b7f6a95d99800c7c6e80828f02ee11014ab742df01aa3c34e121d9f6ef0ab94868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8148d39e3dec58f95a7913d6791ecb5

SHA1
d8180ada537ef626928cedb4f7b91d045158b852

SHA256
da16e5a01be9262ce470fcda70899cfe5eed3879d15b4a445dcfb5761b50de02

SHA512
958c819a5ddcac48a5265a0b5231b413fe5121352a725b166478749f15fca6f9af9364db8ea0d0844057bab3393859f51767490c5be38cb57a5c2d5d825154f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5mrghimd.pfh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Intro.wav

Filesize
1.7MB

MD5
dc28d546b643c5a33c292ae32d7cf43b

SHA1
b1f891265914eea6926df765bce0f73f8d9d6741

SHA256
20dcc4f50eb47cafda7926735df9ef8241598b83e233066ea495d4b8aa818851

SHA512
9d8c1bb61b6f564044aad931e685387df9bc00a92ab5efe7191b94a3d45c7d98a6f71d8ae5668252d6a7b5b44ab6704464d688772aedac8bdb2773d5765d4d56

Download Submit
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
6.9MB

MD5
37a9fdc56e605d2342da88a6e6182b4b

SHA1
20bc3df33bbbb676d2a3c572cff4c1d58c79055d

SHA256
422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58

SHA512
f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
69KB

MD5
f23f6537464f47132cee7632b95daf28

SHA1
1981d5d8ee8e600c613b3c11fdff435172ca725e

SHA256
32824c331cc98500763e67b45e616d9b0f5a63f21b87439d18feaac7b35785cb

SHA512
d58575008b8358c6546f7605d5da27c2fd3578240d679a608c5d15950ce809c0af00dff0b989514a2f3a08e30c697684dcec7695ddbba659e2fa0811280a5a80

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-main.zip

Filesize
26.6MB

MD5
e63875032d805238fc44ca59fd732673

SHA1
df6408dc3ef6e223a79f5667e6a5bbc1ae2ed77a

SHA256
7c65d3e792ca1c0c5ed98143c7ce93684b8e3f78e12d122e5f220f29e2516027

SHA512
8938ac4cf037c6361abaca5bb427a511866a5a596d602be6a3605383f5832f388e7addd605125ba21f60e1cdb986bb1383041c5fba0e02c0b20418c29d8140ed

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\Readme.txt

Filesize
235B

MD5
85122ad50370f9a829b6602384b1b644

SHA1
6d0dc94e7fe82650422a17368314da0da58af6b5

SHA256
444cbc7b57b4a6198ee1474fd9623e1afcb8c7a0b180f05e961a822f4365499b

SHA512
a3ccd49bc0424534ba3b5ee558709022dd31d257ca48fd2eb8d7305ec098dc9275e016da332d293b7cdbdc5e91b82c7602c15abc52c0c0c4f3c81d4126b4afd6

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe

Filesize
7.0MB

MD5
e7c4d689bbf77414ce88ff4726998f06

SHA1
e20fa2ff4022c6653c129dc00820809887d0f82f

SHA256
d5f7895a8daf98f9f96f9f2a9610e9b5fa21c67269c1c534e5c380a7dffd9f70

SHA512
d01815c312625f5468408bf37b2712ddd874b66741b150bec6c4b6703e2df626518f8c16adeb0e4a511abc740f4ff93aa6ce9cb5607003a245078f3a8d8f4131

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
memory/1352-385-0x0000000000E50000-0x0000000000E68000-memory.dmp

Filesize
96KB

Download
memory/1360-387-0x000000001D110000-0x000000001DC7A000-memory.dmp

Filesize
11.4MB

Download
memory/1360-386-0x0000000000450000-0x0000000000B46000-memory.dmp

Filesize
7.0MB

Download
memory/2324-390-0x0000017842190000-0x00000178421B2000-memory.dmp

Filesize
136KB

Download
memory/2660-363-0x00000000001C0000-0x00000000008CA000-memory.dmp

Filesize
7.0MB

Download