bf62d90d7eb8100edb87d091a92c84709cec9607690c44775976ace17703d8e7 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 22:06

Sharing

Report Analysis Logs

General

Target

XWorm-5.6.zip
Size

49.5MB
MD5

c13b9ae52147d0afdb8cb9b8edda5552
SHA1

7fc8347c6243f9d07de7ddffc56b385ca49b25ee
SHA256

bf62d90d7eb8100edb87d091a92c84709cec9607690c44775976ace17703d8e7
SHA512

1b98e79e3c9c6de8da65e38d83e6d94cb9b870da9167f6de7ccc4b82e1f3fb118ac1b2786eaf7f4e96c45275438b89771b61ecf13d9dca88aae0b9b90d6c638e
SSDEEP

1572864:zQP19FRCzRf8cWust/W8kmXDBYl44kjrKm5I+y:zegfSku34kad

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2072	7zFM.exe
Token: 35	2072	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm-5.6.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads