Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
PresentationFontCache.exe
-
Size
705KB
-
MD5
78c86cfe603739c575a5290d8b5bb85c
-
SHA1
52e98defa2d9d428054695e47097cd330cd4a4f1
-
SHA256
1dc33731f7d9da075f20e3900ca8e3c6c593c637fa32703123347bfaae3917f0
-
SHA512
d740bf68c7a4a7200a24926d6b06f3184b5a2d3ac1e7debc4a4eb5f76935c8416c223f802cc3ad5179d641eda92b06687c1a16dc088f626fb71bd412e124c637
-
SSDEEP
12288:ehGB+EDfS8sKMvqg6YBYiZfJMT9hMnJicP8YDTvNC9jCxjt:ehS+EDfSSMvqDYWiZuTrMnkcECTvNKW
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif'3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9049.tmp.bat""2⤵
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f57f2699-a935-4798-b2d9-60d73a47b6ec}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
173B
MD533d6ce49a3745b2008dbe622df6e72d5
SHA1cc5c3d0b42daf4626d8a5d0c8fbd28dae35ce55c
SHA256cfb2a77f360b3affae2b97524d16e4767a0fa6abe4014f65cf53cba735400077
SHA512ad3ac004252a8211887368e2f92ca16c1a6fcb340f692f6e7ec2223b61f5ef66a5b34603e7ffde0281b991b80c0bbf78238a76ce6d95b290f9912dd5c8432748
-
Filesize
154KB
MD5e4a221c1aa52f2ad556625169f99a4e8
SHA13162103447f61788bdcc3b0bedb78381e83abcb9
SHA25621c66e1c50c390a845a05671a0dcef0cc2c4ca557f487720d2286b495014c80a
SHA512679001e5e9e5dfb4609eeef599d5f3b1f40add5e8057dab2a8549dd2aaf05eab209570714055081aa98c2866ee1fb2eafb33263a00ed17c0c7b4183114bf92bc
-
Filesize
169KB
MD56d0e2d59c0f5e36d78aac565d3e18ce8
SHA1c10496332c05b5883f4a55f0228938d7b0c1646e
SHA25672804ca49375a2a0eec509fe7b38c61bfb9adcfb88f5899679abc487c406ab84
SHA512b3a1b2e13c80ef75da3aaf09983b1fda9bfc30c80aee9c191632414c1f912c7c6ae0302307acbec09b1962c79a2a2339dce26013dc33efd84ff829acc4081a39
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
728KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
72KB
-
Filesize
2.0MB
-
Filesize
312KB
-
Filesize
10.8MB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB