Extracted

• • Target

    https://cdn.discordapp.com/attachments/1296491383435296818/1331574935260233778/yes.bat?ex=67921d4c&is=6790cbcc&hm=72c63038324740a7d98f634076c94f75518148e399dec3af1bc10e45781f6f8e&

  Score

  10^/10

  xwormdefense_evasiondiscoveryransomwarerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1