Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1196s -
max time network
1181s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/02/2024, 19:38
General
-
Target
ff.exe
-
Size
57KB
-
MD5
cc210d4f3f1df90c421812660083f6bb
-
SHA1
f0fcad7c0cbeaf178c9680a5a37fcef2229bdd12
-
SHA256
6de45b7c1038dc38aecc42b18cc8ade301a1c756d67caad5fb928e12c631ca7c
-
SHA512
5626183b4743efe77dbddbce49d3f5d55ed7eec83a2e20e711630a85a0b303e8c9fe014fa2e14721a27def010addd8a4c1eb227465cb4ea424ac8320b1adb020
-
SSDEEP
768:zPPUfdr9ZnnkyuRolFRe+8qGT2dCK6kbwTaBxc3mP6dCH+BiO4hRvjPcHx:z8/JkpGRej2skbwToai6dCecO4/LER
Malware Config
Extracted
xworm
127.0.0.1:33725
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3188-0-0x0000000000590000-0x00000000005A4000-memory.dmp family_xworm -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4092 powershell.exe 4092 powershell.exe 428 powershell.exe 428 powershell.exe 2468 powershell.exe 2468 powershell.exe 2980 powershell.exe 2980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3188 ff.exe Token: SeDebugPrivilege 4092 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 3188 ff.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3188 wrote to memory of 4092 3188 ff.exe 81 PID 3188 wrote to memory of 4092 3188 ff.exe 81 PID 3188 wrote to memory of 428 3188 ff.exe 83 PID 3188 wrote to memory of 428 3188 ff.exe 83 PID 3188 wrote to memory of 2468 3188 ff.exe 85 PID 3188 wrote to memory of 2468 3188 ff.exe 85 PID 3188 wrote to memory of 2980 3188 ff.exe 88 PID 3188 wrote to memory of 2980 3188 ff.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff.exe"C:\Users\Admin\AppData\Local\Temp\ff.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ff.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ff.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
944B
MD5b9b360b86f321509992675cbbb2c25f5
SHA1c0dc0f9c0558894eaf0c3769d6381f85c45faa88
SHA2569dcf8030e8774487863580166d2124101c8691de2e2d7f4a4be3cadd810237c2
SHA512375949cd016ea6df701949dab08173e340f25141b7ca067d2baa98ce3c0b3e48b920bb7f2c59cdd4ab8a2c5d3b59cd38f241ea312aef145daef60dec03378af5
-
Filesize
944B
MD5781da0576417bf414dc558e5a315e2be
SHA1215451c1e370be595f1c389f587efeaa93108b4c
SHA25641a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe
SHA51224e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82