Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
234s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09/01/2024, 18:53
General
-
Target
b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe
-
Size
47KB
-
MD5
9cd62c1fb51533c1f12a7403e908e73b
-
SHA1
06f6702cc0ec58ee66d91c876edcb176cc07199a
-
SHA256
b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4
-
SHA512
1087b0d2987ad4662aef5b6ec555544662d543127a3617f8e7afb709d8bcfc4d7ff99cec1513ad0d0a76e2caca7039cf4232da5f2217d41bbfb58fd8cd036078
-
SSDEEP
768:wecbl/b3EMYAoRM5uBFE9RfOqh3bqo5dcWZ635LhlEDSQS:vcx/54FE9RfOqJ2o5d9Z635LhlEDSQS
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
Mutex
kJNeDE0jriPTSPR9
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe"C:\Users\Admin\AppData\Local\Temp\b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB