Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
03/10/2023, 22:18
General
-
Target
XClient.exe
-
Size
66KB
-
MD5
64eb58c834092d3684db2344885ae30f
-
SHA1
20619736c3e5beed9b650c3a572b5831f48106ef
-
SHA256
1c85c49c483c23c8f1985aeb0d04f9f73deea564ca4d2a75ad8563dc84eded67
-
SHA512
79efe57f3705c1cd569082687c0ab2aac365cd0109b6b01557f00ff162ab23f53a86b73588081fda63479b82aa0e2a8d3227d1aebbb2e0783e1e09378f4a1a8f
-
SSDEEP
1536:JD0nJ7L7I5P2or1LK5ka5+bCOdOxn0A6HOtRrT:JI7vaB1Yr5+bCoOQOtpT
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 58 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 17 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'nigaaaaaaaaaaa.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "nigaaaaaaaaaaa" /tr "C:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exeC:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exeC:\Users\Admin\AppData\Local\Temp\nigaaaaaaaaaaa.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD5e05c6a074c19f147d4d87c34f4830668
SHA185240dc4837c167be0070383e6c40d112a5ec4db
SHA256282a751896c0714a8520842926ef475a542151ef24d2c4c691ea8eb817594dde
SHA51257b7e94ff7ee1ecbeef0a4fa85100b27aeea26b7bda981028ef68e26f1661af382cebe82ebb35eb101fe7c7aed71b0548505a907fc13f97594865b510d9a82c6
-
Filesize
1KB
MD5e3270e59b2743d8b9309ecaafce50fd1
SHA127bc245957e7d3328ab83ce4171f003f7b6a0980
SHA25660d81a7f3cd60b8c0bd9ef4d852173840ddad02ac8f3eb0e8c6ebac502a68d5c
SHA512051fad54676a66e58c877c052d8c4f086ae2071667d6b89f2e3c79efc2502d7f27fed9e224d31f75f11b404b6a2f571f533eed9bf7f8fad3905197ffcca4cb6e
-
Filesize
1KB
MD5b924fa1ecb7390aff813a3f814cb7a7f
SHA1d0d5fe9e80593fe7a1f646bd96d4035960f6cddf
SHA25670242616a8f08f2ab19aa0c86ddf6a58b43bd845068f9777c3d0e04ccd8e2892
SHA5129e36524eab3482d3f56f8bf57ff85ac6aa51603da102a0aa82d1173fb4fac66347376535ad1f245a656806f5ad09212ea9a94f4b74a4fb7d10c4d60759bbbbee
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
66KB
MD564eb58c834092d3684db2344885ae30f
SHA120619736c3e5beed9b650c3a572b5831f48106ef
SHA2561c85c49c483c23c8f1985aeb0d04f9f73deea564ca4d2a75ad8563dc84eded67
SHA51279efe57f3705c1cd569082687c0ab2aac365cd0109b6b01557f00ff162ab23f53a86b73588081fda63479b82aa0e2a8d3227d1aebbb2e0783e1e09378f4a1a8f
-
Filesize
66KB
MD564eb58c834092d3684db2344885ae30f
SHA120619736c3e5beed9b650c3a572b5831f48106ef
SHA2561c85c49c483c23c8f1985aeb0d04f9f73deea564ca4d2a75ad8563dc84eded67
SHA51279efe57f3705c1cd569082687c0ab2aac365cd0109b6b01557f00ff162ab23f53a86b73588081fda63479b82aa0e2a8d3227d1aebbb2e0783e1e09378f4a1a8f
-
Filesize
66KB
MD564eb58c834092d3684db2344885ae30f
SHA120619736c3e5beed9b650c3a572b5831f48106ef
SHA2561c85c49c483c23c8f1985aeb0d04f9f73deea564ca4d2a75ad8563dc84eded67
SHA51279efe57f3705c1cd569082687c0ab2aac365cd0109b6b01557f00ff162ab23f53a86b73588081fda63479b82aa0e2a8d3227d1aebbb2e0783e1e09378f4a1a8f
-
Filesize
652B
MD55cefd69822650f5512c7140d551efe63
SHA161ddeeb8d6a0b4226b6a13e4d23a61b20b8a7aad
SHA2565b3bf0b44d054edda5f8759f0bb3a638ec79a75cd1f55e07f26697125b3091a6
SHA512bd6b105710168bc71f0688caa50dff19d602525de19a8e53d2d5c175a148e96ea8eba36d848afa2c40f128277c5b580a2a2fd0399b8138d612c1880ccdfd6edf
-
Filesize
16B
MD5065c7618ac9613b2ea0c0487cff13549
SHA170d72ca533f27f41cc3bf5fb022857cc61760432
SHA256efbabf10bf663bda2dec563fc3809436ba3fa0d7e104d94ce79f0a99dfb47399
SHA5124d4c2964da2d38865974ffc609fcab03d9c5cec8ae673bbf876724d1435d055e1e259745a877bc4a9a0385ce0301f867b9fdc0fc029d5eeaad39f1e4642790fb
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
5.1MB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB