Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    https://send.exploit.in/download/9c73994ce8965362/#aC_WKF2OO0Qz-OzCqgzzfg

  • Sample

    240606-c8ct6sfa6x

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:44454

Name1442-44454.portmap.host:44454

Attributes
  • Install_directory

    %Temp%

  • install_file

    LX.exe

Targets

    • Target

      https://send.exploit.in/download/9c73994ce8965362/#aC_WKF2OO0Qz-OzCqgzzfg

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks