16a21546c9073090dcda3fdfa0779ba9caa9ce3f675bf0cfc0234c2db1dc096f | Triage

Analysis

max time kernel
433s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31/12/2024, 00:24

Sharing

Report Analysis Logs

General

Target

XWorm.7z
Size

14.8MB
MD5

4dd73d277387e57b57be3bd8fac2d0d8
SHA1

276d9a427925166b4e224f357a000ca66e668c77
SHA256

16a21546c9073090dcda3fdfa0779ba9caa9ce3f675bf0cfc0234c2db1dc096f
SHA512

d2c32a46009e5180f4da33033139bd1ebc6dee47eda5999d5d20aa7eca8284d20eed3f5ff0fb45433aa662ddab4c019483dd0190ae75717654c787dd67790cfb
SSDEEP

393216:PXrWzrnWU0Ga6VhaQvNXd5ipq6JjAcnbN7NCrd62nE+NCfF1Q0z:zWzrWUlByQlX/r6hhUrd6sNOF6E

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3220	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3220	7zFM.exe
Token: 35	3220	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3220	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads