Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1556s
  • max time network
    1557s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04/03/2024, 13:40

General

  • Target

    XMClient_Loader.exe

  • Size

    342KB

  • MD5

    70f462c7ee70ad17a46ae90fdedcb0ee

  • SHA1

    e4f4f5ae243dba45aac248f998bf15af1b86cd72

  • SHA256

    912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662

  • SHA512

    36c8d8d28057b3766c61990f17e3f215cdfeb1aa120d6c87361e58a1bc9a5046c3e5206e8d1ba320636228888ad9a576469504404cd9a08311107cfdcf443103

  • SSDEEP

    6144:n5kvyHto7mibWBoukkYkkkk4kkkkmh3VDU+KfUh/GN+aTjquf+WBsmA:Q7+BoukkYkkkk4kkkkmZVDUfcNajjqA0

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XMClient_Loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2336
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
      2⤵
        PID:2768
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF0D4.tmp.bat""
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:2472
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {C03ECE84-4B42-43C4-B34F-35B684D471B8} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Users\Admin\svchost.exe
        C:\Users\Admin\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF0D4.tmp.bat

      Filesize

      167B

      MD5

      a21f8e06b1e029cb21a74788c43566e3

      SHA1

      13db11e1e751b97c0ee9d31c65cc02059f99c792

      SHA256

      55116752dfb38693fafdf9e4ed08f2dcae54a13f87153c93e94f05e8d3e9329c

      SHA512

      403b3b699b158001f10d958e9090337f0e83e1227103d2a06d17d4f48583a6ee3af05dbe828b561770f749e6a03cd12a724e46c017b50301b029034b8eca996c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      ba24c56e8d8cd9594dd4e11497594ec7

      SHA1

      c580f44307c397d08e82b1e51e986cd2e39a3c56

      SHA256

      bb0d07a7ddc2e33e18bb9c1c0d2d5fc949595d81819b55ae072b481ac3eca2ac

      SHA512

      ffc271871021008c6e053cd42d551030b9b3dffad05729e8e4200fa7f2c6dc884c133eb2ba43012e5f9418cd0844b5b4bb94253ec3dfea6e59fa4f50da68e092

    • C:\Users\Admin\svchost.exe

      Filesize

      342KB

      MD5

      70f462c7ee70ad17a46ae90fdedcb0ee

      SHA1

      e4f4f5ae243dba45aac248f998bf15af1b86cd72

      SHA256

      912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662

      SHA512

      36c8d8d28057b3766c61990f17e3f215cdfeb1aa120d6c87361e58a1bc9a5046c3e5206e8d1ba320636228888ad9a576469504404cd9a08311107cfdcf443103

    • memory/788-62-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

      Filesize

      9.9MB

    • memory/788-61-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

      Filesize

      9.9MB

    • memory/788-60-0x0000000000A50000-0x0000000000AAA000-memory.dmp

      Filesize

      360KB

    • memory/1860-51-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/1860-50-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/1860-49-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/1860-48-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/1860-47-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/1860-45-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/1860-46-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/2200-33-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2200-34-0x0000000002E60000-0x0000000002EE0000-memory.dmp

      Filesize

      512KB

    • memory/2200-39-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2200-38-0x0000000002E60000-0x0000000002EE0000-memory.dmp

      Filesize

      512KB

    • memory/2200-36-0x0000000002E60000-0x0000000002EE0000-memory.dmp

      Filesize

      512KB

    • memory/2200-35-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2252-0-0x0000000001010000-0x000000000106A000-memory.dmp

      Filesize

      360KB

    • memory/2252-73-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

      Filesize

      9.9MB

    • memory/2252-2-0x000000001AD20000-0x000000001ADA0000-memory.dmp

      Filesize

      512KB

    • memory/2252-1-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

      Filesize

      9.9MB

    • memory/2252-56-0x000000001AD20000-0x000000001ADA0000-memory.dmp

      Filesize

      512KB

    • memory/2252-37-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

      Filesize

      9.9MB

    • memory/2412-25-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/2412-23-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/2412-22-0x0000000002870000-0x0000000002878000-memory.dmp

      Filesize

      32KB

    • memory/2412-20-0x000000001B630000-0x000000001B912000-memory.dmp

      Filesize

      2.9MB

    • memory/2412-24-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/2412-21-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/2412-26-0x00000000028F0000-0x0000000002970000-memory.dmp

      Filesize

      512KB

    • memory/2412-27-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

      Filesize

      9.6MB

    • memory/2744-13-0x0000000002984000-0x0000000002987000-memory.dmp

      Filesize

      12KB

    • memory/2744-10-0x0000000002980000-0x0000000002A00000-memory.dmp

      Filesize

      512KB

    • memory/2744-9-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2744-8-0x0000000001E80000-0x0000000001E88000-memory.dmp

      Filesize

      32KB

    • memory/2744-7-0x000000001B780000-0x000000001BA62000-memory.dmp

      Filesize

      2.9MB

    • memory/2744-11-0x0000000002980000-0x0000000002A00000-memory.dmp

      Filesize

      512KB

    • memory/2744-12-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2744-14-0x000000000298B000-0x00000000029F2000-memory.dmp

      Filesize

      412KB