37f6ce312e7c9f50c5d45ad18d2f56e338c5a04ff2a2c42e1d0548e31a7afe99 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:52

Sharing

Report Analysis Logs

General

Target

XWorm V5.6.7z
Size

25.5MB
MD5

569318cc811f40d60657e132f80777db
SHA1

3ff667f94d7af962aabea4c1ecf6d54d88500890
SHA256

37f6ce312e7c9f50c5d45ad18d2f56e338c5a04ff2a2c42e1d0548e31a7afe99
SHA512

f5a3b9664e6cf74d137894de7b4bd2167a351d83fe85212b75c3237ef93e24c978f5f73ea401b139e31100d0bf90be9e2f963dafebb8715a84c07661c6062404
SSDEEP

786432:QqVYOR/0YucnsOagpgbD+4aQ3NyAmHvAdp:B/0YucnDgbD+XQ8AgoL

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 3988 7zFM.exe
Token: 35 3988 7zFM.exe
Token: SeSecurityPrivilege 3988 7zFM.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

3988 7zFM.exe
3988 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:32

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE49F1ED18\XWorm V5.6\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit