e63f04c2735e3d0ee6742d58593e7864e659d09ba93918c8beaa95cb009743f6 | Triage

Resubmissions

20-11-2024 03:24

241120-dygwtazhpm 10

20-11-2024 03:19

241120-dvgrmsvjbr 10

20-11-2024 03:07

241120-dmd1saygrg 10

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 03:24

Sharing

Report Analysis Logs

General

Target

XWorm V5.6.7.zip
Size

24.9MB
MD5

2213698ec3e3c474acc535dc58071035
SHA1

fcb9aaa7b05e7078e0e244fb0a71ff5cefeb4ce5
SHA256

e63f04c2735e3d0ee6742d58593e7864e659d09ba93918c8beaa95cb009743f6
SHA512

f03eb21e4f993568ea1d633b86b4584f618cab4874f149e3b5bc2fec71a333045b3cd79e217290100ca34bec0233c226e40ec45593e29ecfa4f817fca8853022
SSDEEP

786432:6ChH2a2UxfDfgSnVpgXhrCT0kw0Q/XbAtILAfoJbx4:ya2UxfDfgSYXhrCTvbQDAt4AfoJbx4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

1116 7zFM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 1116 7zFM.exe
Token: 35 1116 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

1116 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.7.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads