Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/02/2024, 04:13
General
-
Target
GtagAccGenerator.rar.exe
-
Size
221KB
-
MD5
c16112d579dbae6256c076dc562c46e8
-
SHA1
2947a83df8d755eff0293248d332b128729ead47
-
SHA256
6a330a2f685c6526644ba41ccfb45dcc416f1647b49fe7bf45482bc7a133a267
-
SHA512
2b8978d172d14f0a4a3a2de88f320d2510f8a257b052aec903278c25aef2bdbe23a094a166d16d9c3d99f2d7ddaaccba88ea38317f62740b93ddddeb7471afc4
-
SSDEEP
6144:gAJm0dobhTx6UhcX7elbKTua9bfF/H9d9n:g2dU63X3u+
Score
10/10
Malware Config
Extracted
Family
xworm
C2
0.tcp.ngrok.io:8989
Attributes
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GtagAccGenerator.rar.exe"C:\Users\Admin\AppData\Local\Temp\GtagAccGenerator.rar.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB