Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08/05/2023, 15:08
General
-
Target
bMvg.exe
-
Size
41KB
-
MD5
dc455e0fc8fb490a442f90d6809c4acf
-
SHA1
81a5f561e27f4b47d8f9cb75f652590d0b3084f9
-
SHA256
3f81d7b9fd754f15331a5ef322931b07154673d74160c3008b0af32909da996a
-
SHA512
e5bb9b5a56ec774c90fecd05953b093f872a0243082e656ef083a9982381c0973a0db66f3fced6cb38cc69b27b1de355f7f8a27112e1388d167641f9f2e7305e
-
SSDEEP
768:R8ROoJD+YzyzvL0TFe4qjmx7UlOUIIG0h/uRDsQhLODDoR/+t6+:R8ROEDbzyv0BeDjWAIUxNuRv1O3k/+f
Score
10/10
Malware Config
Extracted
Family
xworm
Mutex
DzففZ2wp4RHcلي2I
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/yppjG8bz
aes.plain
Signatures
-
Xworm
Xworm is a remote access trojan written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bMvg.exe"C:\Users\Admin\AppData\Local\Temp\bMvg.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB