Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    patch for version-d8aa63d3654646d0b.exe

  • Size

    82KB

  • Sample

    240523-11gp6aag2x

  • MD5

    3e38bec199f483f558b0330030c4165b

  • SHA1

    5de15adf326e0827ac1162ba5c13648691bd46ca

  • SHA256

    7493e1a3a07f3e5ab65faa623d7c228360e4f3fc3492a5cbf69f1bd1e61da100

  • SHA512

    ebaa9fe2a723d5c77ed4caf6bae973dabdd3da7725b3439fe18d2410a7df7d206d49b3dd506d8ce5e9db0f2bda16a96ff16edd4e2d92fd17b9ec7d993889a802

  • SSDEEP

    1536:dB7gCNuU8ZsEuE0toc3zTB8Xo2FtsCQ7OGCnbSCUUSbK9mXSB6VPZ+bOWgu6Wxh+:dBpP8DqtvDTMqCO6nbSL7+97zbOWguhG

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    win32.exe

  • pastebin_url

    https://pastebin.com/raw/CxfMChwY

Targets

    • Target

      patch for version-d8aa63d3654646d0b.exe

    • Size

      82KB

    • MD5

      3e38bec199f483f558b0330030c4165b

    • SHA1

      5de15adf326e0827ac1162ba5c13648691bd46ca

    • SHA256

      7493e1a3a07f3e5ab65faa623d7c228360e4f3fc3492a5cbf69f1bd1e61da100

    • SHA512

      ebaa9fe2a723d5c77ed4caf6bae973dabdd3da7725b3439fe18d2410a7df7d206d49b3dd506d8ce5e9db0f2bda16a96ff16edd4e2d92fd17b9ec7d993889a802

    • SSDEEP

      1536:dB7gCNuU8ZsEuE0toc3zTB8Xo2FtsCQ7OGCnbSCUUSbK9mXSB6VPZ+bOWgu6Wxh+:dBpP8DqtvDTMqCO6nbSL7+97zbOWguhG

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks