Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
Freemasonry (2).exe
-
Size
5KB
-
MD5
ff7e6dfa113f9f87601e895a40260678
-
SHA1
8e313c176605587b2d9b7111d35c5b51f09f6606
-
SHA256
156c9e8bef9013a1b498d6ba5aa8582ec7f2d02e6123ac777bca863f087e7c62
-
SHA512
53975519c17bf8b24ca46e0326a084e7959e475c47c4e8cd74672dd1a2df570279dd34801460b3fcd630f581aaaff12058b77f09414b411ddac285cc8db45bed
-
SSDEEP
48:6in5YDNwtZdLP10NjDCPp9glLGoNMDyxAoQ5WD9KLGNI6iqAa54tdXl4f59FWpfG:UDOrVmGIIy8UBKS26iBmBQzNt
Malware Config
Extracted
xworm
3.1
-
Install_directory
%Port%
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Freemasonry (2).exe"C:\Users\Admin\AppData\Local\Temp\Freemasonry (2).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"cmd.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4805.tmp.bat""3⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe"3⤵
-
-
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3779c601-e68a-4c07-9829-8bf9f2c846c9}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.exe'1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5440cb38dbee06645cc8b74d51f6e5f71
SHA1d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA2568ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA5123aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
155B
MD570412749cb760f4fda78a981c2852bfb
SHA1ea9ea04d0d3c20ce321df962ec14c02367d1bc57
SHA256e0f70a388a91020d4baf23185c23b16b547e5037a226344373a119c384ac53ef
SHA512c598fbdd5b37ffd912d23575b1aaec8715f532a1705bf36ab10338a0aef69eb3652c9d106e3f9c3cb748e27da4dca627f8e31323b97bf85db4d61fd9e27ebaa5
-
Filesize
300KB
MD53c09d9c6df337337adaa6f3880a318c9
SHA1a4a3a1222476e739e12b28e3bcc8c9dbe2d07fdb
SHA2566f6d67095f0b3ee860ebeb646c7ed14413f1b7cbfccae682109790e84bb461ef
SHA512c0bd827b401ee1cfb4fbc53ceb6f3c40d7d6ee2c14b74832c5367c0df06b37dfd6733b840ebe0f091e6397a35e3b60f11cbbc3db893b68b92b8053c45fd1b24d
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
10.8MB
-
Filesize
328KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
760KB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
320KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
248KB