Extracted

• • Target
    https://cdn.discordapp.com/attachments/1566563454280667270/1566585654274555994/STARDEWONLINEFIX.rar?ex=6ae91415&is=6ae7c295&hm=692723e5fa954063972d34a9e06b7cb81807421f9960879df52f4bfbe50530e9&

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1