Extracted

• • Target
    zzzz.exe
  • Size 32KB
  • SHA256 ab3ee33342d9f4d35d69af94a9759f2031ba04aef4bea4a40ce5172f32d9fc81
  • MD5 b306611c5ec7bfccf00ac68dd2d4f266
  • SHA1 b67e659dfc23a6bb16d420b872198bb52ff87416
  • SHA512 87f525581f88dd788031804d273f916968c7cba80ed81aeca75e18e86c7471efa57984fb83830c2867204314724c3c470a2ac2e94042dd49c990d575bd33e1d5
  • SSDEEP 768:LRPD9OQhx/Bg3Tw46xdVFE9jT6Ojhobz:Ld9OW/g3U46FFE9jT6Ojm/
  • TLSH
    T1E7E23B4877E44712D6FEAFF129F261061270D517E913EFAE0CE485E62B67AC087407E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationransomwarerattrojanadwarespyware

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2