700d08a70214371e8aa4a346c8c17dae07bc36b80e636e10821d2188b99fd247 | Triage

Resubmissions

02/03/2025, 20:45

250302-zjrclavlt7 10

26/02/2025, 01:02

250226-bd45haykz9 10

25/02/2025, 11:55

250225-n3lqnswmx5 10

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 20:45

Sharing

Report Analysis Logs

General

Target

xworm.7z
Size

20.0MB
MD5

6313f4eec0ec1a16bb0e782ca30f842e
SHA1

3ea2a7936b1ed8b028b0a059b1702c7a6cca518a
SHA256

700d08a70214371e8aa4a346c8c17dae07bc36b80e636e10821d2188b99fd247
SHA512

b8d8ffe19a16dfa63ef69ab9086fc191e5dbf9a3645a8e9f755e67163efadfd0817c56b3f484d4af6c4bf884697d019a0d022ec4ad26d9c083b8794a2f70a53d
SSDEEP

393216:cqKeYOG5obypgrFXNDVE4cnsF/v3J3UaAi+ok2D4evUgKRGUceqsvM:cqVYOR2pgbD+4aQ3Ny8D7sgKRtTXvM

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1708	7zFM.exe
Token: 35	1708	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xworm.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads