Extracted

• • Target
    ad4fd7eef4728d7112417f93ca6d5cc410ec29f4d6c820c0160dd6de0e7d69d4.bin
  • Size 46KB
  • SHA256 ad4fd7eef4728d7112417f93ca6d5cc410ec29f4d6c820c0160dd6de0e7d69d4
  • MD5 546c8682f117ccd519616604b63770db
  • SHA1 732e7fbd5494b2badbc4b8d02f85857516299908
  • SHA512 cf74b2861b7fe946a368bcbd0f18684a2f1095ee68a34e4b0047fc1c6bf369c7267300e99421df1e90153c1db2488f256aeaeab8167889eefd0b1ba0f988fb8b
  • SSDEEP 768:jO3YNqt7FhypfDGNKjC3vGYK+7F/kbNMRVFI3QC/KWtM2W99hL/L:a3Wqt7F0VGN8Cy+7VkbNMRv+QCSWe2WB
  • TLSH
    T16D23395837E54322E2BEAFB558F17512C639F6035803E69F38C0459B2663A88CED57F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2