Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
NisSrv.exe
-
Size
286KB
-
MD5
4105f6abba105cc27f89c2ebfc0c06b9
-
SHA1
416adb89cdf50bc1dffd5d386a391a2c32bec3a9
-
SHA256
dddac27a8c4fc66d1fdbe65cddae474b50f5b21a0bdc7f02594426089d898cc8
-
SHA512
c73a124afa416227b7b9e297934e5f454f7fe5bab229e0e95a633517bffbd61026accaa6c0573757be5e2f60afc80bcaf70000a20d9b60190935715c8d206541
-
SSDEEP
6144:pu0CsWLsWwYnZqiXMhD5RL3t8os+E4sch8pP6Dv8NubGv3xcD89eL:4CWNwuZvXMB5DuGsch8QDvt8i
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NisSrv.exe"C:\Users\Admin\AppData\Local\Temp\NisSrv.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wind32.exe'2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wind32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wind32.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wind32.exe'3⤵
-
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{aaf4782f-06c9-4846-aa50-eb58dae9d20b}1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
355KB
MD555ab75d168d110fa869e0dade4510172
SHA130e05525914ddbdc88b95a4148c2b56cca03e0cc
SHA256f345fc3969b1f0183b6b8738ab3633c0b840763910f3825f1a3bc2e963648589
SHA512b565faf3ddd44ce9b25864195475b46cc7ed8bf26b61158deeb1d1f98fc3cb4a105baba97fa9546315fe6234bb3e1077800a7bbad99d33341b0f17d367409a03
-
Filesize
1KB
MD52f09b0bbb99a876f4c686f783301071c
SHA1e56e2874f0b8a7ae1af384cb1191089d49c92da4
SHA256ef7a4b9378596b034ab801ba6114c413e16358e28445c467697b08cdbcafd57c
SHA5122bc1787bfc6e1d85a6c48ba5afaf07ae3f5b0395a776f8f4380e7b02f36b5a1ff0607437647f245433244571a4ee950b84da340d01f12b2bc20488e08d7be09b
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
312KB
-
Filesize
2.0MB
-
Filesize
376KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB