Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xworm V5.6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xworm V5.6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Xworm V5.6.exe
- Size 14.9MB
- Sample261024-lpzn9sys8r
- SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
- MD5 56ccb739926a725e78a7acf9af52c4bb
- SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
- SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
- SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
- TLSH T10EF69D107BD68006E47269B00A946AE199BEBEAF2B15D8AD30C4335C17F64CCF953BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6072 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 6072 taskmgr.exe Token: SeSystemProfilePrivilege 6072 taskmgr.exe Token: SeCreateGlobalPrivilege 6072 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6072 taskmgr.exe 6072 taskmgr.exe 6072 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"1⤵PID:4520
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1708
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3040