463eb31b863993ffc7ebd1e67a593c0fc01bfcef367a988191926facfb93d93a | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 22:26

Sharing

Report Analysis Logs

General

Target

XWorm.rar
Size

3.8MB
MD5

72ed99d6168329b94021eaf282af0552
SHA1

0be0ad479efa7b5d3021b06ab5f6b71f858ba08f
SHA256

463eb31b863993ffc7ebd1e67a593c0fc01bfcef367a988191926facfb93d93a
SHA512

b11c5657389e8e6f5af5bdbef2b22daef62e26484117c9a30de184a63980e6108cd804e43db7494f24057eaeec32ced7ab5ebd6f7aedb6467a207a209a2bd2a7
SSDEEP

98304:AdRaDzmLW/nQDItjvhd8cMOBmYS1svAJFFa6XmeuwSqUjGMtokcqh:AAearjJd8vNYNQFzEvBVtoFqh

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1596	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1596	7zFM.exe
Token: 35	1596	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1596	7zFM.exe
1596	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads