ee0b405b3e166fa9c1062ac6bed228b4ca7f990ce2dc62305d15ae4b3e6e35f1

Analysis

max time kernel
843s
max time network
850s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RES/XWorm.StartupManager.resources
Size

167KB
MD5

3e7ce35b2e085ba831d417d582b249b9
SHA1

63926a8d61ef3eb1e9408e9c531ce35adba66886
SHA256

73d138786a5f08114204491631867e44f5d1d60a683890509c7f69a78198c60e
SHA512

27a6de57b2c88a8d1119232ef123e728b4f1bf9aedaae8caa026bdce9541ef61c4c3d5a59fb4c7613febbae5f5e19ae754c51a4ae9176f2eca5dc03d938048ac
SSDEEP

1536:LasebR3b313F3F3goXjmtt32325JT8J8pjq9bTQPmbYakBxBW/7jpYaGS7ETH1Q0:L9eS5JyTaxw7jpY7SYLe7HkrVOih

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2252	AcroRd32.exe
2252	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2224	3012	cmd.exe	31
PID 3012 wrote to memory of 2224	3012	cmd.exe	31
PID 3012 wrote to memory of 2224	3012	cmd.exe	31
PID 2224 wrote to memory of 2252	2224	rundll32.exe	32
PID 2224 wrote to memory of 2252	2224	rundll32.exe	32
PID 2224 wrote to memory of 2252	2224	rundll32.exe	32
PID 2224 wrote to memory of 2252	2224	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RES\XWorm.StartupManager.resources
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RES\XWorm.StartupManager.resources
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RES\XWorm.StartupManager.resources"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f21ad15dd8e5e5d5fee6e2734877c68e

SHA1
51eefaa80d1ba7efb1ff0a1d3a3e207faf0b3629

SHA256
ee29af6cc7d9886b809a9239bc28f76bdd44429bc83e09373f67b08f2e2a8345

SHA512
a9a8db4edef732e1670b969b3b8f28f064444968e740b5b529070d0b4e0905af9afb27154d0ecfb47a54ebe93544ce3667032b5f00dc94e2b19fabf4bc8c91dc

Download Submit