Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 18:07
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20240226-en
General
-
Target
XClient.exe
-
Size
67KB
-
MD5
c9cd80d55733208fc06b8b52cddb52dc
-
SHA1
6cc60302d90e7d7661b5b194fa954efacba19d49
-
SHA256
5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552
-
SHA512
befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa
-
SSDEEP
1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3
Malware Config
Extracted
xworm
silver-bowl.gl.at.ply.gg:29206
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2244-1-0x0000000000D50000-0x0000000000D68000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2860 powershell.exe 2704 powershell.exe 2788 powershell.exe 2564 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Loads dropped DLL 1 IoCs
pid Process 2244 XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2860 powershell.exe 2704 powershell.exe 2788 powershell.exe 2564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2244 XClient.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeDebugPrivilege 2244 XClient.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2860 2244 XClient.exe 29 PID 2244 wrote to memory of 2860 2244 XClient.exe 29 PID 2244 wrote to memory of 2860 2244 XClient.exe 29 PID 2244 wrote to memory of 2704 2244 XClient.exe 31 PID 2244 wrote to memory of 2704 2244 XClient.exe 31 PID 2244 wrote to memory of 2704 2244 XClient.exe 31 PID 2244 wrote to memory of 2788 2244 XClient.exe 33 PID 2244 wrote to memory of 2788 2244 XClient.exe 33 PID 2244 wrote to memory of 2788 2244 XClient.exe 33 PID 2244 wrote to memory of 2564 2244 XClient.exe 35 PID 2244 wrote to memory of 2564 2244 XClient.exe 35 PID 2244 wrote to memory of 2564 2244 XClient.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD510d7ddaafb43872471f74067df8e48b0
SHA1e17566b2fab56a095f6aec3fa7e5927d856e8d15
SHA25633091a778904203277bc82f7428fa1cff3749dd0cea4bacc31edd9fda98e1af6
SHA512ac74a2fe86705b0c6ca01eefb48a89129c1d1d97ae88c14f5a9c93a5c181cf2eee8f0c7b897fafc278cb2b05900b298cdd86993c499a089b9bdae05e778805b8
-
Filesize
100KB
MD51b942faa8e8b1008a8c3c1004ba57349
SHA1cd99977f6c1819b12b33240b784ca816dfe2cb91
SHA256555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc
SHA5125aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43