Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
210s -
max time network
215s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
18/09/2023, 04:32
General
-
Target
XClient.exe
-
Size
31KB
-
MD5
84afc004f218a31313fd717d06a75bb8
-
SHA1
7a248fed7fcbf4bf750bb705ba33c70d152a67f4
-
SHA256
02ab2ec0690885256c90e55f8ed3cce050cdb0bf0ad86859a9d75520130e226e
-
SHA512
dfab537903db2352e0a3d0294e2ac0d0f64bce2b026e04c590dae4d2666037582a10ba61bf17401ea21a81e47e4e476de7b1e69bd05991fdec40329519e1b584
-
SSDEEP
384:TWrVqCDweO/ace/VgFpLJPXwDs2ETIiqqR+gtFqBLTiZw/WNCvK9IkVuE0xOjhQi:bzT5gePqqZFr9RL2OjhQ/7vW
Malware Config
Extracted
Family
xworm
Version
3.1
C2
6.tcp.eu.ngrok.io:4545
Mutex
zgJ5izy4K73qDOdL
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/644-0-0x0000000000F60000-0x0000000000F6E000-memory.dmp family_xworm behavioral1/files/0x000800000001af06-14.dat family_xworm -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2260 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 644 XClient.exe Token: SeDebugPrivilege 2260 taskmgr.exe Token: SeSystemProfilePrivilege 2260 taskmgr.exe Token: SeCreateGlobalPrivilege 2260 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe 2260 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:644
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2260
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771B
MD530fb6876dc2cef9104586fa155187639
SHA1617129a31526fb31ae22d323ce88460b2514bdd7
SHA256453e1359a3f4083f76308ff09af236bf46208f95a2cba1cf5368b775a1e376f3
SHA512970d07611434ea22d30a34353c8ae4e593ccd1b4477ed552414a76f6c08fc48542636d0b303dc9441e121e7759c86a0767b749ffea390963a87b0a74e4e94245
-
Filesize
31KB
MD584afc004f218a31313fd717d06a75bb8
SHA17a248fed7fcbf4bf750bb705ba33c70d152a67f4
SHA25602ab2ec0690885256c90e55f8ed3cce050cdb0bf0ad86859a9d75520130e226e
SHA512dfab537903db2352e0a3d0294e2ac0d0f64bce2b026e04c590dae4d2666037582a10ba61bf17401ea21a81e47e4e476de7b1e69bd05991fdec40329519e1b584