Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/05/2024, 18:11

240508-wsqkwage4w 10

08/05/2024, 18:07

240508-wqltxaah47 10

Analysis

  • max time kernel
    121s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 18:07

General

  • Target

    XClient.exe

  • Size

    67KB

  • MD5

    c9cd80d55733208fc06b8b52cddb52dc

  • SHA1

    6cc60302d90e7d7661b5b194fa954efacba19d49

  • SHA256

    5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552

  • SHA512

    befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa

  • SSDEEP

    1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3

Malware Config

Extracted

Family

xworm

C2

silver-bowl.gl.at.ply.gg:29206

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    10d7ddaafb43872471f74067df8e48b0

    SHA1

    e17566b2fab56a095f6aec3fa7e5927d856e8d15

    SHA256

    33091a778904203277bc82f7428fa1cff3749dd0cea4bacc31edd9fda98e1af6

    SHA512

    ac74a2fe86705b0c6ca01eefb48a89129c1d1d97ae88c14f5a9c93a5c181cf2eee8f0c7b897fafc278cb2b05900b298cdd86993c499a089b9bdae05e778805b8

  • \Users\Admin\AppData\Local\Temp\tmp9C8D.tmp

    Filesize

    100KB

    MD5

    1b942faa8e8b1008a8c3c1004ba57349

    SHA1

    cd99977f6c1819b12b33240b784ca816dfe2cb91

    SHA256

    555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

    SHA512

    5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

  • memory/2244-31-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

    Filesize

    4KB

  • memory/2244-1-0x0000000000D50000-0x0000000000D68000-memory.dmp

    Filesize

    96KB

  • memory/2244-2-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

    Filesize

    9.9MB

  • memory/2244-33-0x0000000002170000-0x00000000021AA000-memory.dmp

    Filesize

    232KB

  • memory/2244-0-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

    Filesize

    4KB

  • memory/2244-32-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

    Filesize

    9.9MB

  • memory/2704-14-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2704-15-0x0000000002C70000-0x0000000002C78000-memory.dmp

    Filesize

    32KB

  • memory/2860-8-0x0000000002960000-0x0000000002968000-memory.dmp

    Filesize

    32KB

  • memory/2860-7-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

    Filesize

    2.9MB