Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
XWormRCE.rar
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWormRCE.rar
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target XWormRCE.rar
- Size 835KB
- Sample261030-e7ptfsdc37
- SHA256 87b906aacbfd127f2dae5aa3ea423a27b3ae05dad8611faa15caac7daf7f1871
- MD5 b21274043b4321bf7c4060b34dd5b9bf
- SHA1 101d5d841eb69dd5c155b89eb644a2f9ca9a8b1b
- SHA512 a0c94740c39c333c6567f8f1e2e9ab90a6c0e38bb26cfdfb54ef1b62d1c455b1df8e408f503847fce2533db889969adeae0123bb32038f0775876c92a2706f8b
- SSDEEP 24576:a2JiPTfuVo3ypzWobEBwb/nziOYe4BPmp:a2JiPTf8Yyp6ovb/nzt4W
- TLSH T14F05337109DEA4DC59B0EADFE432E6EE237B965B1D230C583261FE4011AF8EC8D19764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2984 7zFM.exe Token: 35 2984 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 7zFM.exe