711424f96c15750ec6f131656f1771e53ab353be79473badc1a46de6834cd60d

Analysis

max time kernel
516s
max time network
1610s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/07/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWorm V5.2.zip
Size 54.5MB
Sample240709-2f4jvszdlr
SHA256 711424f96c15750ec6f131656f1771e53ab353be79473badc1a46de6834cd60d
MD5 fd8b28debcaa238b3bc2b032eaaecf94
SHA1 213709cc82562433023db864fe66f95050bd0bc5
SHA512 31a14fd0da4366c05189c8bbb3f06260fbb182e0a13262ca59a786945ba9d75e0f85b71d34a61c1f7e5f1f561aa98758e90bda89057daf2f8ae2dad0a8bd4544
SSDEEP 786432:nIagoCEXKlCpMqIEJkseGG+5ELbzcFdcyt5/ks3FkAPYxpL+q7RRHEm+0NyvZZGb:nJgXCzIsGrPzcFrt1F3Yxxrr+4yvZ0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
756	XWormLoader 5.2 x64.exe
4328	XWormLoader 5.2 x32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1972	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	5112	7zFM.exe
Token: 35	5112	7zFM.exe
Token: SeSecurityPrivilege	5112	7zFM.exe
Token: SeRestorePrivilege	532	7zG.exe
Token: 35	532	7zG.exe
Token: SeSecurityPrivilege	532	7zG.exe
Token: SeSecurityPrivilege	532	7zG.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5112	7zFM.exe
5112	7zFM.exe
532	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.zip"
1⤵
PID:2304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3252

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5112

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\pass.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1972

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\XWorm v5.1-5.2\" -spe -an -ai#7zMap10459:84:7zEvent27106
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:532

C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe
"C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe"
1⤵
- Executes dropped EXE
PID:756

C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
"C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"
1⤵
- Executes dropped EXE
PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

icon (15).ico

Path C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.1\Icons\icon (15).ico
Size 361KB
SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
MD5 e3143e8c70427a56dac73a808cba0c79
SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWormLoader 5.2 x32.exe

Path C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
Size 109KB
SHA256 2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
MD5 f3b2ec58b71ba6793adcc2729e2140b1
SHA1 d9e93a33ac617afe326421df4f05882a61e0a4f2
SHA512 473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495
SSDEEP 1536:5vjAnXqn2nY7WfRMgPQQrMoqmyVttdGFQeOPigx:5LCan2nY7sdQQAoqmyBeu
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWormLoader 5.2 x32.exe.config

Path C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe.config
Size 187B
SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
MD5 15c8c4ba1aa574c0c00fd45bb9cce1ab
SHA1 0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8
SHA512 52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4
MD5 SHA1 SHA512

Submit Download

XWormLoader 5.2 x64.exe

Path C:\Users\Admin\Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe
Size 109KB
SHA256 b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2
MD5 e6a20535b636d6402164a8e2d871ef6d
SHA1 981cb1fd9361ca58f8985104e00132d1836a8736
SHA512 35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30
SSDEEP 1536:TYogSlNwXosKwOYtV1AS9m3xQyVGNNiLkWNF7XxFqmyVttdGFQeOPigx:TvgSlqGS9m3xQyKNbWNV3qmyBeu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pass.txt

Path C:\Users\Admin\Desktop\pass.txt
Size 22B
SHA256 42c1ae00022dc8087ef52b64162dd04b21cddf2e4206f2c448030b259270daa3
MD5 c29395b5db85764ecfa7a807221e67a0
SHA1 b5e7dedba5a692ac08743f5abec8cc5e8581bf8f
SHA512 a8f6041c55ce4450d895102f6133435f644765554e7409245d23bd232a90f53a0d4c93e7401beb58b6de91e1c1ad11442898c5c49ad69908f140371c36dfe921
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads