Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
cmd.exe
-
Size
305KB
-
MD5
17a914cf391fd8afff071aaa9dbb6d0e
-
SHA1
bdc7aecf8298fc9742cc2d093b39a93d69b56d90
-
SHA256
fb8ca27363234ce063f034f47bce0ff739273d6880ac93c32ac89750a9bbae3a
-
SHA512
ccae9abe5e6116fad65699382bf5641a83bd94b7d95ed9159ea0176d2887d226f092ab97cb271d7cacec250c1aa78c0ba8eda75d6e19c6836b2bd2c648f75278
-
SSDEEP
6144:I7qJFjwoMUnZqaXMhJ99LJJ8KsnlXfEUcP87PyXvUGRhIc/9oLCm:I7qJOBiZlXMT9BwnllcP8WXvvh
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Delays execution with timeout.exe 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5786.tmp.bat""2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bf6d5219-dab9-4bbd-b343-8d028b6d6152}1⤵
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5440cb38dbee06645cc8b74d51f6e5f71
SHA1d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA2568ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA5123aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
155B
MD52bb73cb3a4077f5b9b9685588f17443e
SHA11ce71c64dd01fce9e97c12b770327d5097e633cc
SHA256c0e6ff6a2066053de70d6a07dfa00ab2aa5cf211f80b4ec8cf66afd4290ef32e
SHA5122d940cc790812737624f730aee21c8ff1995570e44610416507b8fda8c7094960eff5a3f19a982f1120cc52c4e6e89b464b5bb9a345f7334f5c71541c183688b
-
Filesize
300KB
MD53c09d9c6df337337adaa6f3880a318c9
SHA1a4a3a1222476e739e12b28e3bcc8c9dbe2d07fdb
SHA2566f6d67095f0b3ee860ebeb646c7ed14413f1b7cbfccae682109790e84bb461ef
SHA512c0bd827b401ee1cfb4fbc53ceb6f3c40d7d6ee2c14b74832c5367c0df06b37dfd6733b840ebe0f091e6397a35e3b60f11cbbc3db893b68b92b8053c45fd1b24d
-
Filesize
229KB
MD5a2ecfb09c044e8eb23ee1144a56bd64b
SHA11acad030ec7ebd7cd26de8f149028bfea9d39b4b
SHA256b7a64fd3cd86fdeafde7a727ec47db2a23d3416b4e023bc5d7216e38a48f1e2e
SHA512037a61de7f7c392d67849f9a5005dce9bcf7a1c4f428138c1ef38df45ffd1939547f7b6ff51beb78def50076defd94439a830c98cc8ebae0e380375e4ce7aa58
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
256KB
-
Filesize
760KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
80KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
328KB
-
Filesize
10.8MB