Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 11:25

General

  • Target

    10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe

  • Size

    296KB

  • MD5

    5fac40a82226f46504aef22f79233ad7

  • SHA1

    c4035a3190fa59840aad19156711c63199d9812e

  • SHA256

    10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6

  • SHA512

    b0fa9ea2dabf45aff55c45499489f2c7a414815664532d0d4579c94f78fe9feb8e5175f49c31e3a6d35694c99911cb6b1dfcf4b49da27ee9d17fe5cba3aa958b

  • SSDEEP

    3072:uCmy2JV7y4nWfFCPP/7SQDADn1qlOJqrC96hJSIqdsITzauJ4iTJOrDqK+kLQJ5S:uy1faP/DAD1zB9ySIYzauE9+k

Score
10/10

Malware Config

Extracted

Family

xworm

Version

3.1

C2

xwormfresh.duckdns.org:7002

Mutex

Ytep6ubSVJFcAJf5

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Users\Admin\AppData\Local\Temp\10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2220
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
      2⤵
        PID:4444
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6_JC.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        2⤵
          PID:4408
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:3992
      • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        1⤵
        • Executes dropped EXE
        PID:2284
        • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
          2⤵
            PID:3304
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
            2⤵
              PID:1652

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

            Filesize

            296KB

            MD5

            5fac40a82226f46504aef22f79233ad7

            SHA1

            c4035a3190fa59840aad19156711c63199d9812e

            SHA256

            10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6

            SHA512

            b0fa9ea2dabf45aff55c45499489f2c7a414815664532d0d4579c94f78fe9feb8e5175f49c31e3a6d35694c99911cb6b1dfcf4b49da27ee9d17fe5cba3aa958b

          • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

            Filesize

            296KB

            MD5

            5fac40a82226f46504aef22f79233ad7

            SHA1

            c4035a3190fa59840aad19156711c63199d9812e

            SHA256

            10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6

            SHA512

            b0fa9ea2dabf45aff55c45499489f2c7a414815664532d0d4579c94f78fe9feb8e5175f49c31e3a6d35694c99911cb6b1dfcf4b49da27ee9d17fe5cba3aa958b

          • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

            Filesize

            296KB

            MD5

            5fac40a82226f46504aef22f79233ad7

            SHA1

            c4035a3190fa59840aad19156711c63199d9812e

            SHA256

            10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6

            SHA512

            b0fa9ea2dabf45aff55c45499489f2c7a414815664532d0d4579c94f78fe9feb8e5175f49c31e3a6d35694c99911cb6b1dfcf4b49da27ee9d17fe5cba3aa958b

          • memory/2220-18-0x0000000005160000-0x0000000005170000-memory.dmp

            Filesize

            64KB

          • memory/2220-15-0x0000000005FD0000-0x0000000006062000-memory.dmp

            Filesize

            584KB

          • memory/2220-17-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2220-16-0x00000000058D0000-0x00000000058DA000-memory.dmp

            Filesize

            40KB

          • memory/2220-7-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2220-10-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2220-14-0x0000000005160000-0x0000000005170000-memory.dmp

            Filesize

            64KB

          • memory/2220-8-0x0000000005030000-0x00000000050CC000-memory.dmp

            Filesize

            624KB

          • memory/2284-21-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2284-22-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2760-11-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2760-4-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2760-6-0x0000000004D90000-0x0000000004DA6000-memory.dmp

            Filesize

            88KB

          • memory/2760-5-0x0000000002630000-0x0000000002640000-memory.dmp

            Filesize

            64KB

          • memory/2760-1-0x0000000075010000-0x00000000757C0000-memory.dmp

            Filesize

            7.7MB

          • memory/2760-3-0x0000000002630000-0x0000000002640000-memory.dmp

            Filesize

            64KB

          • memory/2760-2-0x00000000050D0000-0x0000000005674000-memory.dmp

            Filesize

            5.6MB

          • memory/2760-0-0x00000000000E0000-0x000000000012E000-memory.dmp

            Filesize

            312KB