Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
23/12/2023, 12:41
General
-
Target
x.exe
-
Size
320KB
-
MD5
c940e89943c98832a5738d260f16bf94
-
SHA1
b422d97d5d59fe0ac82bcb379e2c1d4a27f77618
-
SHA256
4001c4f249a156e7e9410886ddaf8ca7652689eb914a57d3bb17c1284f79dab1
-
SHA512
44587a723fa9d51d5dfb216181bdab33987aedd32cff30eec72363425b6de228a7bc51b84fc66214f81b4b398edc70723839d8e979f533595b140cb52bc31cbd
-
SSDEEP
6144:7DKW1Lgbdl0TBBvjc/RUizNnjLF00mpPGy5Bmfb1cdmhCq3t:Ph1Lk70Tnvjchnjx004uyefbcU3t
Malware Config
Signatures
-
Detect Xworm Payload 2 IoCs
-
Detect ZGRat V1 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\x.exe'2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x.exe'2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\taskscheder.exe'2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskscheder.exe'2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskscheder" /tr "C:\Users\Admin\AppData\Roaming\taskscheder.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\taskscheder.exeC:\Users\Admin\AppData\Roaming\taskscheder.exe1⤵
-
C:\Users\Admin\AppData\Roaming\taskscheder.exeC:\Users\Admin\AppData\Roaming\taskscheder.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418B
MD52f51ee33b74ab710e289b65a7b580c9b
SHA1031f919473e89c4a463360c7a898fda986836470
SHA256bdb480893a7d1acc95b67f49dd12a0c1f69b75d1908536d0cc1350ebfbb5cc58
SHA512927bd82da2cc751b6b2c97efc33019b8977f2d78d467b363cf609e27a3ac8986e0b4c3b4d025be9fe87f50db51285b115b97ae7d0ae642daae2910d44ad9ec5a
-
Filesize
18KB
MD5705b42e5bceb6f544f74c697bd6cebe6
SHA1442ab903b3b5d88edcb7d6214f0805a5383d7625
SHA2569ae53d48fda1ca651efd7cf02017939f6808835e72beb2b9350bfcfdaa9235e7
SHA512d5332b14ab08d14c5305f02ef618b1ef2f6c960310ba37bf1ec1e847dd653d08ee352fe09ad7db07d206910b8255a3c2a152e40c6e06bf3c7886c9b49e38c432
-
Filesize
18KB
MD517850920e5ba9076ea4af851c0522f43
SHA129e2a81444b537d25845172baef50c1f4526aa95
SHA256f1ea8c07c4bb695773e716d65560a8dae24e03c4f6bb60768a811bd8309aac57
SHA512c3ba8f3faa8ebb533a47a55b3af0b5d587546f32bf19d117a1ee55ed42e8a6958367774ceb336cdd2ed89d20065c311145738c7c19ede89dec88ff7ad79d5213
-
Filesize
9KB
MD596192d5e5b95ca7ba29c5be29da1e12c
SHA1e4d4ad7306c21240471a4cc91c2bfaacf8e9cfad
SHA2562761f15f7a187e2582da086869d4c965219dc3d1b0209ade992983a5f29dc5cd
SHA512dec49d097a2639c96c235d628622c254302b9e3de98cb1133d6e03860b77e61ec60493db08b8a000bbe22492c7f375a88777e80df63c588a5205ed18cafff1bc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
29KB
MD5966133184fddeec8bd9971ca3a8aa4bb
SHA1348959180d65286516cab4849dc63ce90aca8d6a
SHA25608d67fe13f86ccf0f436a0d2e9e5e64ca4f1d5c6bb64d16ab89cce9be4b29539
SHA5123cc97260eb0414b3c1990b76aaf2bd6a8e93e1e03f9c6238f23d354648aa631eebf63c69b0e80f5c79bec61cdf84b8fe30b93523bf81afd47078a6ad527203cc
-
Filesize
30KB
MD52d16979a34b26a5ec50ef3b897718f83
SHA1250a8623bab92894e532bd11d3ccab5142d9eacc
SHA256182dda67da473fd7cfbd329129f6c5f2275840bc7eee2b27e3417608d108702c
SHA5128f597c51f26ed02d55859f7f5a8753abf83aa10b735fffeec9cd362fe8cfd864e87fa7abd9d5e08c884f508f9b6282240e3aea4f45c608927a5091a6e189b045
-
Filesize
17KB
MD5f7b861fdbfb0552421c80fa501fdbb6e
SHA16e9513a69fb49a2769abe64e6d911393bd9c9105
SHA256b666d36f10ed6c49c43a634969bb53912dd9b5c9d6ceac8b9ee37e5c1be19fd3
SHA512aadb40a7b7f69c8b610af79eb6feed0b116aad880d7bf728cb10cba8b0d41a6418a4d679da467f131a39586dd9365bb7bb28a7dc3b11cc3ea1bb4b9b44825ee6
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
416KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
416KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
600KB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB