Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
patch for version-d8aa63d3654646d0b.exe
-
Size
82KB
-
Sample
240523-11gp6aag2x
-
MD5
3e38bec199f483f558b0330030c4165b
-
SHA1
5de15adf326e0827ac1162ba5c13648691bd46ca
-
SHA256
7493e1a3a07f3e5ab65faa623d7c228360e4f3fc3492a5cbf69f1bd1e61da100
-
SHA512
ebaa9fe2a723d5c77ed4caf6bae973dabdd3da7725b3439fe18d2410a7df7d206d49b3dd506d8ce5e9db0f2bda16a96ff16edd4e2d92fd17b9ec7d993889a802
-
SSDEEP
1536:dB7gCNuU8ZsEuE0toc3zTB8Xo2FtsCQ7OGCnbSCUUSbK9mXSB6VPZ+bOWgu6Wxh+:dBpP8DqtvDTMqCO6nbSL7+97zbOWguhG
Behavioral task
behavioral1
Sample
patch for version-d8aa63d3654646d0b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
patch for version-d8aa63d3654646d0b.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
win32.exe
-
pastebin_url
https://pastebin.com/raw/CxfMChwY
Targets
-
-
Target
patch for version-d8aa63d3654646d0b.exe
-
Size
82KB
-
MD5
3e38bec199f483f558b0330030c4165b
-
SHA1
5de15adf326e0827ac1162ba5c13648691bd46ca
-
SHA256
7493e1a3a07f3e5ab65faa623d7c228360e4f3fc3492a5cbf69f1bd1e61da100
-
SHA512
ebaa9fe2a723d5c77ed4caf6bae973dabdd3da7725b3439fe18d2410a7df7d206d49b3dd506d8ce5e9db0f2bda16a96ff16edd4e2d92fd17b9ec7d993889a802
-
SSDEEP
1536:dB7gCNuU8ZsEuE0toc3zTB8Xo2FtsCQ7OGCnbSCUUSbK9mXSB6VPZ+bOWgu6Wxh+:dBpP8DqtvDTMqCO6nbSL7+97zbOWguhG
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1