Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

App.exe

windows7-x64

7

App.exe

windows10-2004-x64

7

Freemasonry (2).exe

windows7-x64

10

Freemasonry (2).exe

windows10-2004-x64

10

Freemasonry.exe

windows7-x64

3

Freemasonry.exe

windows10-2004-x64

7

NisSrv.exe

windows7-x64

10

NisSrv.exe

windows10-2004-x64

10

Presentati...he.exe

windows7-x64

1

Presentati...he.exe

windows10-2004-x64

10

SecurityHe...2).exe

windows7-x64

10

SecurityHe...2).exe

windows10-2004-x64

10

SessionService.exe

windows7-x64

10

SessionService.exe

windows10-2004-x64

10

SgrmBroker.exe

windows7-x64

10

SgrmBroker.exe

windows10-2004-x64

10

SocketHeciServer.exe

windows7-x64

10

SocketHeciServer.exe

windows10-2004-x64

10

cmd.exe

windows7-x64

10

cmd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a chunk of shit.rar

  • Size

    3.5MB

  • MD5

    ebe6a4fc37e257521bfbe3c593179e39

  • SHA1

    bc0bf4cc638f7e3dd90f6d6cecdb33ea4ed3cf91

  • SHA256

    ebf760dbfa32628221a5a902ffd7e98f560d181225e260ed4326aa36aa99f659

  • SHA512

    71091fb188e78a9a0adb1dbd00ee7f76aacf706a99fd039386bfed28f4f7bfbd73274229dda711a1d3f8c1c98a05817a81d7bcde282b34540b1f50651d8b02a1

  • SSDEEP

    98304:egd23vOGWgsB/mhZdBxXivtJ7dRHdbLyJo12nuRW6D7:eg+PhZd+1X5db+uR17

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.1

Attributes
  • Install_directory

    %AppData%

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm family
    xworm
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • a chunk of shit.rar
    .rar
  • App.pif
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Freemasonry (2).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Freemasonry.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • NisSrv.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • PresentationFontCache.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SecurityHealthService (2).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SessionService.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SgrmBroker.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SocketHeciServer.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • cmd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections