37f6ce312e7c9f50c5d45ad18d2f56e338c5a04ff2a2c42e1d0548e31a7afe99 | Triage

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/11/2024, 01:52 UTC

Sharing

Report Analysis Logs

General

Target

XWorm V5.6.7z
Size

25.5MB
MD5

569318cc811f40d60657e132f80777db
SHA1

3ff667f94d7af962aabea4c1ecf6d54d88500890
SHA256

37f6ce312e7c9f50c5d45ad18d2f56e338c5a04ff2a2c42e1d0548e31a7afe99
SHA512

f5a3b9664e6cf74d137894de7b4bd2167a351d83fe85212b75c3237ef93e24c978f5f73ea401b139e31100d0bf90be9e2f963dafebb8715a84c07661c6062404
SSDEEP

786432:QqVYOR/0YucnsOagpgbD+4aQ3NyAmHvAdp:B/0YucnDgbD+XQ8AgoL

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1488	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1488	7zFM.exe
Token: 35	1488	7zFM.exe
Token: SeSecurityPrivilege	1488	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1488	7zFM.exe
1488	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE0D5BA697\XWorm V5.6\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit