Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 13:54

General

  • Target

    tmp.exe

  • Size

    38KB

  • MD5

    c07bd6f1db41c8a777f7315b254e9c42

  • SHA1

    6151b17545888c1304e8b6b28a2071fe94c9e79f

  • SHA256

    49ea02a2e7f76432f2b474d07bbdd250543671e084e5e8c99a096b46af30d95d

  • SHA512

    83979cc3f66d72931815be5a283b754c7a972fd1dbcf0df500f93e3c4d221407a26b047e8c6ec9f65113f2846db0aad46d88bf3cf8a3b8c47d26a0485155f8dd

  • SSDEEP

    384:uRpzjSrmqWzFVTD+i8cEv2uBLYRVAGpK94rFo1c0/pkFMAzNLTOZwg3OcvK9IbjD:iFuCzADYRy94Bo1cTFh9P8OMhS4j

Malware Config

Extracted

Family

xworm

Version

5.0

C2

79.133.57.122:7000

Mutex

pvC9E3QrtLsVzQQr

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1948-0-0x0000000001210000-0x0000000001220000-memory.dmp

    Filesize

    64KB

  • memory/1948-1-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

    Filesize

    9.9MB

  • memory/1948-6-0x000000001B380000-0x000000001B400000-memory.dmp

    Filesize

    512KB

  • memory/1948-7-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

    Filesize

    9.9MB

  • memory/1948-8-0x000000001B380000-0x000000001B400000-memory.dmp

    Filesize

    512KB