b52bc0e94ae7c823753777aab3223ec9eda314584744c7bd7a2c624e68ad5028

Analysis

max time kernel
433s
max time network
436s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-12-2024 10:10

Target

XWorm v5.1-5.2/XWorm/XWorm V5.1/Readme.txt
Size

235B
MD5

85122ad50370f9a829b6602384b1b644
SHA1

6d0dc94e7fe82650422a17368314da0da58af6b5
SHA256

444cbc7b57b4a6198ee1474fd9623e1afcb8c7a0b180f05e961a822f4365499b
SHA512

a3ccd49bc0424534ba3b5ee558709022dd31d257ca48fd2eb8d7305ec098dc9275e016da332d293b7cdbdc5e91b82c7602c15abc52c0c0c4f3c81d4126b4afd6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 5032	1536	cmd.exe	79
PID 1536 wrote to memory of 5032	1536	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2\XWorm\XWorm V5.1\Readme.txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2\XWorm\XWorm V5.1\Readme.txt
  2⤵
  PID:5032

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact