Extracted

• • Target

    X64v1.4.exe

  • Size

    76KB

  • MD5

    1a6ce13e6ca5801d773725074d8127a6

  • SHA1

    abc2d87c256950524ea6bc06466b7ad63dec042f

  • SHA256

    0cea3395a719813d0a1bab5a21ded480f70b6da0cff2b8ff632a0d42bee303fe

  • SHA512

    461708a2a62701c4af06d54e0c86fa5380c12a464a1e208c539f7835f4c5b0f3d4064377674759e0f9b237971b9414f9c39acf9da455aabacdb8ca2ea1018d10

  • SSDEEP

    1536:F01NQngfiQr1jx9/9EBeJKYamex+3tDUUGcDl3nIAd7CK8byIMn:y1KgF/9+FYajk3tDUUGCBIa7CK8by1

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1