Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
cmd.exe
-
Size
305KB
-
MD5
17a914cf391fd8afff071aaa9dbb6d0e
-
SHA1
bdc7aecf8298fc9742cc2d093b39a93d69b56d90
-
SHA256
fb8ca27363234ce063f034f47bce0ff739273d6880ac93c32ac89750a9bbae3a
-
SHA512
ccae9abe5e6116fad65699382bf5641a83bd94b7d95ed9159ea0176d2887d226f092ab97cb271d7cacec250c1aa78c0ba8eda75d6e19c6836b2bd2c648f75278
-
SSDEEP
6144:I7qJFjwoMUnZqaXMhJ99LJJ8KsnlXfEUcP87PyXvUGRhIc/9oLCm:I7qJOBiZlXMT9BwnllcP8WXvvh
Malware Config
Extracted
xworm
3.1
-
Install_directory
%Port%
Signatures
-
Detect Xworm Payload 3 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2BB2.tmp.bat""2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'3⤵
-
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{dbb690f9-a633-4386-a592-7a0a5f4903d9}1⤵
-
C:\Users\Admin\AppData\Local\Temp\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp343A.tmp.bat""1⤵
-
C:\Users\Admin\AppData\Local\Temp\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A2F.tmp.bat""2⤵
-
C:\Users\Admin\AppData\Local\Temp\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8298.tmp.bat""3⤵
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD58e33572ab2a25a808c3ff17c6711afe3
SHA15231891d6841c9dcfdcc4f9adb0a1d8d7050cc7d
SHA256bc5ad80808680df02ba312805a2e76bb3b1d974eccdcc866bbec8d2eda3f0f49
SHA512bfd143b39216114095bacc9dd142bbc6de0bde217f2c0cb7455158e61ea0e35a6f4f14a707321aeeed34b1578642c6815c922e654be2db007456d86bbded87c7
-
Filesize
155B
MD52aadc553e57f7d532f359853a3b369e8
SHA1b741ff72327cb0a0d22b505767d360cdae201521
SHA25679e60840a38364057d829e7fd5d329c02286e59e670844272a28e8870916df99
SHA51263152f8e608f9ad2ca4eb55a6717a3e7299a2ed15007b9e72f468a0a87ccba703b3a92ce816783f35f910fa510aabfedce5559aa17a299b115d22173ef5b6e80
-
Filesize
155B
MD569b9cb1405d98e717045ddd78b485b0e
SHA1930643d666cf34669f46a7a5f506068032db300b
SHA256fc10fa6670cfff00f9b6f923a01872560afa9343e4b8846beb85d66354dd1fc8
SHA5127fea0bd8e241e1ed7eba54bb7d3044ec38f9b6731ee7bb22942e02bf6319d7e92d8a925c81eea0e5ceb0ff63e45f5afde278017eb665936124e83b3766eaa443
-
Filesize
155B
MD52f964cb575008d4cab0f39e291810eb6
SHA1e9c27769659cbce7259ed567247d53811337f78a
SHA2566c59068d55cf02ae50efce1a13b5c7313b8e3145a7d7145a255e79c6ec78de56
SHA5122916f98efea7901d72efc40ee3e404bc4d22931dfbd07b24eb54fe66f12f966ec7176e27a65589c9775cd6ee1b94beabe962cfaa250076c205674086e1e6c759
-
Filesize
7KB
MD50fda3510c1bfe96214ce93bcf304b2dc
SHA14150024fb990ee5e3d098569e79f079012cc72a4
SHA25695f2ece0f0cf831ddce0ad63eed27213162b262f9444678366870da1b9d8d581
SHA512796fd73d9df648877f058f8daaaabde00b1882d98d168b14d963895960a420bc4087b373f3f00592cf91bb1067ac45ee66932f123520ea87d9a5df031ccd14f3
-
Filesize
300KB
MD53c09d9c6df337337adaa6f3880a318c9
SHA1a4a3a1222476e739e12b28e3bcc8c9dbe2d07fdb
SHA2566f6d67095f0b3ee860ebeb646c7ed14413f1b7cbfccae682109790e84bb461ef
SHA512c0bd827b401ee1cfb4fbc53ceb6f3c40d7d6ee2c14b74832c5367c0df06b37dfd6733b840ebe0f091e6397a35e3b60f11cbbc3db893b68b92b8053c45fd1b24d
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
328KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
256KB
-
Filesize
1.1MB
-
Filesize
80KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.7MB
-
Filesize
9.9MB
-
Filesize
1.1MB
-
Filesize
248KB
-
Filesize
320KB