6b66904ae1929991852392fe2d578712738799cdd82539507d714f536eb8e0ed | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 03:59

Sharing

Report Analysis Logs

General

Target

Xworm.V6.0.zip
Size

28.7MB
MD5

ce625cf1e3e25d470c2e7a298409dab2
SHA1

94f465e9baa3099c2a7b8e5d30e8fc481b0b41a3
SHA256

6b66904ae1929991852392fe2d578712738799cdd82539507d714f536eb8e0ed
SHA512

0ac55745455542d68be326f5e5d48131da093ba47c24cfd06c2be0f3f0651219bf692b3fed5ac62cd16a191c0f7852b73ef8bc709f344eb3b36948b44bc3a480
SSDEEP

786432:OHqaRtCZZfm0+lGmlNinnXEDggGiO72vAgbHGaG:OHqytCO0+lF0hgGZNgbHGp

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2664	7zFM.exe
Token: 35	2664	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xworm.V6.0.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads