9e0c79e062d3fc16c0c1599df4e8ae73dfe1fac6191766047831e7c3fcb6cf6b | Triage

Resubmissions

25/02/2025, 02:18

250225-crebnswnt6 10

25/02/2025, 02:14

250225-cnywxawk14 10

25/02/2025, 01:27

250225-bvjvwsslt6 10

Analysis

max time kernel
409s
max time network
516s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25/02/2025, 01:27

Sharing

Report Analysis Logs

General

Target

xworm.7z
Size

18.5MB
MD5

cceec836b15bfab2ce08828642145c32
SHA1

86742f0bbd6e29d4e62ca988c397093dc8d7a3f0
SHA256

9e0c79e062d3fc16c0c1599df4e8ae73dfe1fac6191766047831e7c3fcb6cf6b
SHA512

de44c7f423c27cbbcaedcddd0faf5b483e8337ade9e0f930e6c0ddbb174cd641bbb13ac5d762e025a701a6dc4fc768ed737d461a4ab5296d54f1c9dc2480f441
SSDEEP

393216:FqKeYOG5obypgrFXNDVE4cnsF/v3J3UaAi+ok2D4evUgKRGUG:FqVYOR2pgbD+4aQ3Ny8D7sgKRtG

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1300	7zFM.exe
Token: 35	1300	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xworm.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads