4c68fc7cfea0b998be9ebc730f6fb64453111463cc97a05832f826bd5c95c70a | Triage

Resubmissions

11-11-2024 22:32

241111-2f212axldw 10

11-11-2024 22:25

241111-2b6hnaybkd 10

11-11-2024 22:10

241111-13dfhsxhkh 10

Analysis

max time kernel
241s
max time network
278s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-11-2024 22:25

Sharing

Report Analysis Logs

General

Target

XWorm V5.6.7z
Size

18.5MB
MD5

6df23ee40cdb76bcbaf9debadabadd54
SHA1

98113a1537411c368d33691af4d7b03b4019b828
SHA256

4c68fc7cfea0b998be9ebc730f6fb64453111463cc97a05832f826bd5c95c70a
SHA512

198472da9d16717d5607541b26951c113e821cca95a204c8973b3b3f92ed42eba35dc42ab2a4efa193c404319a64c34c90b35837ab4c924c1dba3a3fcce55292
SSDEEP

393216:CipL2GD+ki9oXFJan9qqBYpusMUO8hEx2sidgNwVgs5517:CiF2k+f9oXFmq9pusMX8axD6355F

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2916	7zFM.exe
Token: 35	2916	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads