Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
SecurityHealthService (2).exe
-
Size
863KB
-
MD5
e52b5a8920cb3377b0b965cff2511976
-
SHA1
750741e2b260c02f0e0c1f0a556630fd65aa04e1
-
SHA256
817875231b62f3c9513a011b6d008592bb37178b07f163f3d517170516ea8c1b
-
SHA512
ee9f8702d46343eed8a5c3f3755967f20f3c844af608150a926152da0828c31708f585280c004a5615e08cf9742fb9089a728ecf4d9360e29b51d9bd78e8060b
-
SSDEEP
24576:+mKZ0BH6VpcusvRVl/1C+ZiBnonvsciQvtEMvqDYWiZuTrMnkcECTvNh:+f0BH3Zv93iBnqWZYtuTr4j
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Extracted
umbral
https://discord.com/api/webhooks/1188379475021410374/Ssj5Ns9zjIl8_hao3wt15snRVqwtBYjDt8QLCtqPC4z6ltGHrqIRWciPemKhTAJ3Ea_2
Signatures
-
Detect Umbral payload 3 IoCs
-
Detect Xworm Payload 5 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecurityHealthService (2).exe"C:\Users\Admin\AppData\Local\Temp\SecurityHealthService (2).exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif'2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlwriter.pif'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sqlwriter.pif'3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dwm.pif'2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CTCMSGoU.pif'2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dwm.pif"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dwm.pif"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBEDC.tmp.bat""2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CTCMSGoU.pif"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CTCMSGoU.pif"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bbec3c2d-1299-4dac-9303-0c66a0e0d619}1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{d52a1af8-58a8-4848-a95a-b8f0e85a5534}1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{488829bf-75a4-43f3-b99c-4ff8d79f3973}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'1⤵
-
C:\Users\Admin\AppData\Local\Temp\rjaxnou0.sxq.exe"C:\Users\Admin\AppData\Local\Temp\rjaxnou0.sxq.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 5002⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
6KB
MD535d003b4a84d8661fc8c927542981719
SHA113265c2458e33643a5e8b41824070763c1f6da83
SHA25636c8842a93d288427b5685d8376ded24a4a0aaf4047322260ed443acb46dcfb2
SHA5122c088042ee4580a60425858c45d9fc157311ff0027213d2c4778b9ec992b7bb967582812f8f22747badbedb4b30d2db681b01aae7c7e59c5086d34c4feeda9ee
-
Filesize
177B
MD5c27b84ed14a60e14be3ec5435c313cef
SHA1630267bbc1558b3cdd0b92234bbdf75bad0b99ee
SHA256e12573e2b9c139e2ed553b5f8fa2701364babfbd1a477c7360039a909f9ad842
SHA512ca867b20f6524e8be3903b41daf4728d08650d5b663ce763126d58d1b3333f2a56e03b76eb950a774581dc4ab98ae027d01e004de506f2698462024741e9183e
-
Filesize
7KB
MD5819f08664df5045e57b8322a35fbf9e8
SHA1ccce5c364dcc03981fcfc434a9b61bf5627ae9e2
SHA256a7a4b15d3a090ab423cc05c94cc6211a5e2dad52efce6a2bf177ab34f4a4fc17
SHA51273776b7c65bba1fbb1547655d5028f494047285ed59e2765d1eeefc45a0164fec741b2e3ffda20dcad41ad5ab860a72513ffecb2ae4bbf870cb51559e001af1b
-
Filesize
252KB
MD5377111513c87b0eaaa6717391bf563ef
SHA1a92f2cc4de43d2b0f6a1c698aa310923242c7233
SHA256a0cf07b6b46c06354319588f5434284459f1519f56f08c9b1be839793679b3f7
SHA51221af9fbdd39b6d18195b0149ca17e2421c38fdb2e2fa8647168d8ded4d62ef800d23d61388c5d3f1362018de15d917feb369f06c5f7d63a6b9e0d29be5f4d325
-
Filesize
475KB
MD5a3f67757b8aa84290a1de1ef02bb147b
SHA1d34536606c53bacfbff56ac51bca69eb8757aa9d
SHA2563e55185676c6d873dd32f0666d7310a31d7ad929b13f254e5abfa989b7aae8fb
SHA512ee1e9e1a9599ba1c20f7501fbf7b01bbb2e1fe59e9351b74435e733c0e6b082df5d65b84bad647990cba309ddca7718b48ef63fe0e267b8403798a8d4020b075
-
Filesize
296KB
MD5a00574cdeaca49c3ac3e06df82085900
SHA1ab702747dcf9dc84876fbef8efe85aabaa6b5c61
SHA256d885201537d61e47e478ad598df977af89c4aaf52b3d6d2fd4ebdab713e36c90
SHA5128f65826392a623d765fc06171989bea9688f288bdbb1b89a2bda90f10e664fee01cb6933ff60b1bcf4ea27bba7bd53e77febe5ca4b36c0906a1aa3d7756f4b3d
-
Filesize
234KB
MD5484d7da0efb1bd320bd78caad2a24a4d
SHA1c0fc070bce9e17d964ea18ee0c9f60ec343a2d23
SHA256c13097b35e1098013da603b3ab9d9af07c5d618d99b061e6539785a548416752
SHA512bc45cf593ef0e42b550b01085032daa0932a7e50ce524965aa73c0165aecfee8ea46adf5354071f1122a78cdf2d5e74f5b47e195db428e8c72edc6cfcd2d0581
-
Filesize
32KB
MD5dd4c1164627f732c1431bb15fe551d85
SHA100a4ec3ff503f48823fcecddb76dbc39c3c412d8
SHA2564e1257844daa4f457ec1cf75b352bad13c180e5c23aa44975cf48e7e8d08a67b
SHA5127e1d9e52d3760fbf6d42d1579ea2cae4900f15e7318d95c64c4f63a974985197cea11f30bb2f31d6ef8fd4ec88fb32943ce59327e3be4e4912f7ee7902d00a4b
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
1.1MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
32KB
-
Filesize
272KB
-
Filesize
1.1MB
-
Filesize
328KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
256KB
-
Filesize
9.9MB
-
Filesize
496KB
-
Filesize
1.7MB
-
Filesize
1.1MB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
1.7MB
-
Filesize
312KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
1.7MB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
1.7MB
-
Filesize
9.9MB
-
Filesize
888KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
256KB
-
Filesize
1.1MB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB