Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1196s
  • max time network
    1181s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/02/2024, 19:38

General

  • Target

    ff.exe

  • Size

    57KB

  • MD5

    cc210d4f3f1df90c421812660083f6bb

  • SHA1

    f0fcad7c0cbeaf178c9680a5a37fcef2229bdd12

  • SHA256

    6de45b7c1038dc38aecc42b18cc8ade301a1c756d67caad5fb928e12c631ca7c

  • SHA512

    5626183b4743efe77dbddbce49d3f5d55ed7eec83a2e20e711630a85a0b303e8c9fe014fa2e14721a27def010addd8a4c1eb227465cb4ea424ac8320b1adb020

  • SSDEEP

    768:zPPUfdr9ZnnkyuRolFRe+8qGT2dCK6kbwTaBxc3mP6dCH+BiO4hRvjPcHx:z8/JkpGRej2skbwToai6dCecO4/LER

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:33725

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff.exe
    "C:\Users\Admin\AppData\Local\Temp\ff.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ff.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ff.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    1a9fa92a4f2e2ec9e244d43a6a4f8fb9

    SHA1

    9910190edfaccece1dfcc1d92e357772f5dae8f7

    SHA256

    0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

    SHA512

    5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    b9b360b86f321509992675cbbb2c25f5

    SHA1

    c0dc0f9c0558894eaf0c3769d6381f85c45faa88

    SHA256

    9dcf8030e8774487863580166d2124101c8691de2e2d7f4a4be3cadd810237c2

    SHA512

    375949cd016ea6df701949dab08173e340f25141b7ca067d2baa98ce3c0b3e48b920bb7f2c59cdd4ab8a2c5d3b59cd38f241ea312aef145daef60dec03378af5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    781da0576417bf414dc558e5a315e2be

    SHA1

    215451c1e370be595f1c389f587efeaa93108b4c

    SHA256

    41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

    SHA512

    24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kernh3g5.0r0.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/428-26-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/428-29-0x000001F86F220000-0x000001F86F230000-memory.dmp

    Filesize

    64KB

  • memory/428-32-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/428-27-0x000001F86F220000-0x000001F86F230000-memory.dmp

    Filesize

    64KB

  • memory/2468-45-0x00000272A2E80000-0x00000272A2E90000-memory.dmp

    Filesize

    64KB

  • memory/2468-34-0x00000272A2E80000-0x00000272A2E90000-memory.dmp

    Filesize

    64KB

  • memory/2468-35-0x00000272A2E80000-0x00000272A2E90000-memory.dmp

    Filesize

    64KB

  • memory/2468-47-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/2468-33-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/2980-48-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/2980-57-0x000001586CA80000-0x000001586CA90000-memory.dmp

    Filesize

    64KB

  • memory/2980-62-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/2980-60-0x000001586CA80000-0x000001586CA90000-memory.dmp

    Filesize

    64KB

  • memory/2980-58-0x000001586CA80000-0x000001586CA90000-memory.dmp

    Filesize

    64KB

  • memory/3188-1-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/3188-0-0x0000000000590000-0x00000000005A4000-memory.dmp

    Filesize

    80KB

  • memory/3188-30-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/3188-67-0x000000001B330000-0x000000001B340000-memory.dmp

    Filesize

    64KB

  • memory/3188-68-0x000000001B330000-0x000000001B340000-memory.dmp

    Filesize

    64KB

  • memory/4092-2-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB

  • memory/4092-5-0x00000168C9910000-0x00000168C9920000-memory.dmp

    Filesize

    64KB

  • memory/4092-10-0x00000168C9910000-0x00000168C9920000-memory.dmp

    Filesize

    64KB

  • memory/4092-4-0x00000168B1460000-0x00000168B1482000-memory.dmp

    Filesize

    136KB

  • memory/4092-16-0x00007FF9E11D0000-0x00007FF9E1C92000-memory.dmp

    Filesize

    10.8MB