Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
SocketHeciServer.exe
-
Size
326KB
-
MD5
b31a895d0c68b927f671ad83cd75746a
-
SHA1
feeeb2c2221b40f07eb5f8a61b42fa74b515777d
-
SHA256
dfffdd9f71b964ea17dec2660be833b0ecf007e239a3e44f4b8108967557d78a
-
SHA512
7dde6e228200f7776d5ed2414e4fc1c19f487f8a77719f0af87ad612f605dcc87bd525192d3819c8eb022a9d9e563ab87308d6c08adc70cece6f7b83b2e99e93
-
SSDEEP
6144:sjJL98jtwguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOksDRb:DjtkKLBwiZlzMB9xgndcP88DvvP
Malware Config
Extracted
xworm
3.1
209.25.143.223:505
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e9d01d2c-99fc-4a6a-8924-37a819244d3a}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe"C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77SocketHeciServer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77SocketHeciServer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe'2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SocketHeciServer.exe'2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD514db9088692b83f365d9133d3d421764
SHA163673dbdc222230f21dc52ae75885c1a0c7db7e8
SHA256e726a5394a486842d74d9c8d9a540968f742d3113fdecf11e34ecd5cedb6111b
SHA512806bcd5d0e1b164a11b96fe30428c20dd681d41c87b9fbb549fb5179747684b651b1d5169efa0a9f08cdea40ff319af12582172cdc66f2fbba6dd728bba54c67
-
Filesize
51KB
MD58ee82e26070502a8781544fd914c4850
SHA18a10500cd26833f4003377dbbf77b52a1cf5d749
SHA256d3353f185f6dec27583535c771caf0707c163bf44e0395e6f57f5fa2cc31c231
SHA5126ed6cffc86209c253b3b59456e77078b03a7805781533befa4863ae4d02ad2315e17b2bba2fae84834ac712b9e22a730d6ccfa96e11af9ec73640a9508002c49
-
Filesize
80KB
MD54dafc6fba4b58011f2978693b5b19669
SHA1aab87e2aadfacf367ddffa177565d54c98a64273
SHA2564c136ba3dbaecafb90bbb17fae00d3a2d198eae776e7601b89457de159d41802
SHA5123bb52eb61c5a1b8452862892f2e28fcccc0263224379a5d9a286b0fa11123bac8dd965ee888b923815160b0f34ec3cb0f024e5222bfd06b2b5265526e6f245bd
-
Filesize
142KB
MD5b2b17c1d7abc80fba62b6ecfb10b309e
SHA13bb4d043d2434582a631ce3f8c1c5e8a729815b4
SHA256418cd127329c248e99a1265b1c5bbbe281bd11d49413a63e2966f86c296a32b7
SHA512f8833db0169203e60d5f3b8452d81e8762b195ee7756628e4c5168c258e6e42c363ae71d11871c08b2b462c96592914ff4d4418fe7be355776fe082dd38b9dd9
-
Filesize
92KB
MD58421b5829817bff94616e684324ef6e8
SHA1e0847f5850a8d79ea80aa1c9238ac96d5075dc19
SHA25697a12ec8fe964a75cb85915bc0362d827217dcb139dec1dba0ef388c77c77b6d
SHA51295e3789d1a58b377966ed2bbbedc5dfacc74dbd75d29ff2f66fcfa9a2c18f5923233a875d3e2205c7ac7aa14c78da3b604c83666cb2b97b9b8c201748f22f455
-
Filesize
114KB
MD5bee5d91b496fb80f633b314b1dbb55eb
SHA125c99dd2d14166bdb16a3b0238204fa8c0094780
SHA25660f1cd5bc3deb6245e628c6be28bb5425e9c9c24437832929f4d55265ce51334
SHA512468c5745197bf8a044236dcb86ee398d269e35ef1c93bceb171c9e99bd2bcb39240cbe8280daa8f3d0af4f93b616a47d5d73188c3d2fce244f9ad2e089e2f460
-
Filesize
231KB
MD5c48768811593df0a56239db8ebd85b44
SHA1f5b725ecf98643a0449e933cf5c10b31a03e2d85
SHA25663dbdb68d50b213fa23d09fbb75b39724a301445f605adb700243709db4cc96a
SHA512902fa23ac98d8e4890bf979091ffeca1c636aee7140d3d85f5a6c6a9a7c56f4f78fc14a945791d1703de8e980709efcc2228b8d85e4e01a23c19d2e846797fca
-
Filesize
88KB
MD5dd6415a82461ebf3899ed38e5ec3bfe7
SHA17235ea37f45eba41130d68397a633f66e9eb1b7c
SHA256431f5ab4f268bdbb29ee8c814b7c677e28ab55a7e7ff245bdbf3d5c393efb7d6
SHA512b4dc009749d5d7037b314f5e9f8a160dd47bc5e09423df5e635c00ce8c829e0603edc768460a8b98e23ed00507a40f09eeba6b88dbe561583608029fcedf97c1
-
Filesize
135KB
MD5bf8d84635931c0afc2ca8482ad3bb04a
SHA1334d02695b3f287ea024da3bc1f5998c0d4f22ea
SHA256606dbc56acad526c205bc9069a474c2d2c861b7dfae45332b7af17a9569b0f12
SHA5122dfae26072698bb722b9d4477166748334fa1b0ce900c6caa1aa920e61a1adcbb7fcd717c791ea6e0e546303dc426b856bfdf3dd047d3383a1671953ec068021
-
Filesize
80KB
MD5e8b62b0880de0c1ce6070815c3f795d1
SHA14e1b88dc2db652ac0ef67b5f178a4b6aac37b0b3
SHA25660bc9380942ab176942a842b50158c50b98f9904141437d65d6b208a46e9e482
SHA512a6f60928ad4cd79c6aa3bf47edab1a0a7c492b7a4981e8dbf7a5c4ebd880eba7d81b08c275e1536d6eec8b506bc5c82fc17755fc6ca5dc496f84fe936847236a
-
Filesize
39KB
MD5d639f5bd4e92ce4bf954837dd1357e19
SHA129865890eacf8120385f065c070d80bd2e97c715
SHA256c9f9c6df34312b03aa930cd4adaece9f7b58ef667685f2d9e0ac4cfba509f9b4
SHA512f2a04f259e1f3c04e4ed9256f3b106988c955d7ce28866253129e9ec66a13b028839becc4d2f222b9a01d725c61309dd577affcb5c3e06c1eff7d3c5f1a16a54
-
Filesize
104KB
MD5b7feb2bb4aacad2752df757f525ffb4b
SHA1d5cf280ef27942e6669a9bc157968cf2a7e9f9fd
SHA2569761cd25e4ba68a43b1ac87ce8c39f6b4e304daef6cc0eeadd5d66abcccc8237
SHA5126aa0aa0b2661742df8653fe186a956d815e8732adad8a39782dc6a61418c9f0c766aec2a5c93e0e240b8204bc2e1426da5f6b72e9bcc2532ac0b6beb5c7a1edd
-
Filesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
1.1MB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
412KB
-
Filesize
32KB
-
Filesize
168KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
168KB
-
Filesize
1.7MB
-
Filesize
344KB
-
Filesize
112KB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
248KB
-
Filesize
9.9MB