Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/05/2024, 18:11

240508-wsqkwage4w 10

08/05/2024, 18:07

240508-wqltxaah47 10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 18:07

General

  • Target

    XClient.exe

  • Size

    67KB

  • MD5

    c9cd80d55733208fc06b8b52cddb52dc

  • SHA1

    6cc60302d90e7d7661b5b194fa954efacba19d49

  • SHA256

    5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552

  • SHA512

    befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa

  • SSDEEP

    1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3

Malware Config

Extracted

Family

xworm

C2

silver-bowl.gl.at.ply.gg:29206

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Extracted

Family

xworm

Version

3.0

C2

plus-loves.gl.at.ply.gg:59327

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
    • C:\Users\Admin\AppData\Local\Temp\DUTWIOIJLVIEVXQ.exe
      "C:\Users\Admin\AppData\Local\Temp\DUTWIOIJLVIEVXQ.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DUTWIOIJLVIEVXQ" /tr "C:\Users\Admin\AppData\Roaming\DUTWIOIJLVIEVXQ.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3568
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3688
    • C:\Users\Admin\AppData\Roaming\DUTWIOIJLVIEVXQ.exe
      C:\Users\Admin\AppData\Roaming\DUTWIOIJLVIEVXQ.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4924
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4d8 0x3d4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4940
    • C:\Users\Admin\AppData\Roaming\DUTWIOIJLVIEVXQ.exe
      C:\Users\Admin\AppData\Roaming\DUTWIOIJLVIEVXQ.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DUTWIOIJLVIEVXQ.exe.log

      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      bd5940f08d0be56e65e5f2aaf47c538e

      SHA1

      d7e31b87866e5e383ab5499da64aba50f03e8443

      SHA256

      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

      SHA512

      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      ef72c47dbfaae0b9b0d09f22ad4afe20

      SHA1

      5357f66ba69b89440b99d4273b74221670129338

      SHA256

      692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

      SHA512

      7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      ab24765a7393bd3cef8acbf0a617fba2

      SHA1

      ef2c12a457a11f6204344afed09a39f4d3e803cb

      SHA256

      3a03c7efabe880ae9f283b1cf373d3f09d07ab619028319b3599b643ae140d47

      SHA512

      e16306674a8c89f54467d7fba3857e1e0bdf3729f5de9f4451520cfbddfa535c4d653dde6efcac38efd693e9b3e4965fcd08c559e720c372feca65050b46e355

    • C:\Users\Admin\AppData\Local\Temp\DUTWIOIJLVIEVXQ.exe

      Filesize

      185KB

      MD5

      e0c8976957ffdc4fe5555adbe8cb0d0c

      SHA1

      226a764bacfa17b92131993aa85fe63f1dbf347c

      SHA256

      b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

      SHA512

      3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

    • C:\Users\Admin\AppData\Local\Temp\T9OQ3CCZ99IBWTB.exe

      Filesize

      4KB

      MD5

      376b9f7d42c2931c70dce613d9365b33

      SHA1

      ed647069236227e15a6af9dc7751d09c0846bf6e

      SHA256

      7b925997a63520b61a49ad2b62008b4ae41b7877639a716adc86f6d28aea0f77

      SHA512

      9dfd00a8f2e2d8e1c6823481fa17cbad4b05017359fbd701377525d4347dc7609280be5b0f9b5a82b541cfabf2cc2e698bacf8e07750156a3bd53a8d962abe54

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo050a3j.xkx.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1464-3-0x0000028F26560000-0x0000028F26582000-memory.dmp

      Filesize

      136KB

    • memory/1464-18-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-21-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-14-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-16-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-4-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-15-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/2440-82-0x0000000000D80000-0x0000000000DB4000-memory.dmp

      Filesize

      208KB

    • memory/2960-61-0x000000001B590000-0x000000001B59C000-memory.dmp

      Filesize

      48KB

    • memory/2960-0-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp

      Filesize

      8KB

    • memory/2960-55-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/2960-2-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/2960-17-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp

      Filesize

      8KB

    • memory/2960-95-0x00000000010C0000-0x00000000010CA000-memory.dmp

      Filesize

      40KB

    • memory/2960-100-0x000000001CE70000-0x000000001CF20000-memory.dmp

      Filesize

      704KB

    • memory/2960-101-0x0000000020BB0000-0x00000000210D8000-memory.dmp

      Filesize

      5.2MB

    • memory/2960-1-0x00000000008F0000-0x0000000000908000-memory.dmp

      Filesize

      96KB