Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1047s -
max time network
1047s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23/06/2024, 13:04
Behavioral task
behavioral1
Sample
cmd.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
cmd.exe
Resource
win10v2004-20240611-en
General
-
Target
cmd.exe
-
Size
66KB
-
MD5
0680a239ba405c1935c687ebdf6d4540
-
SHA1
bf2cc8de357fe1af9888e120e1c139ca2bc77c15
-
SHA256
10db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d
-
SHA512
09ff2d0449404f7b704cb8270ceecfc87d84c42c202a55ce20fb425230d81f5bf8a798c1c52a2a1ed19c599ad8d2f72188c561d734dd79ac70b7973fbd07fc73
-
SSDEEP
1536:44Sw2KfDxiZcy2fdbdFSQ37E6vObaKjG:4OL1yGdbdF5ZObPG
Malware Config
Extracted
xworm
medical-m.gl.at.ply.gg:28857
-
Install_directory
%ProgramData%
-
install_file
Runtime Broker.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3876-1-0x0000000000490000-0x00000000004A6000-memory.dmp family_xworm behavioral2/files/0x000e000000023439-62.dat family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4800 powershell.exe 2352 powershell.exe 4956 powershell.exe 4292 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk cmd.exe -
Executes dropped EXE 17 IoCs
pid Process 2844 Runtime Broker.exe 2588 Runtime Broker.exe 372 Runtime Broker.exe 2980 Runtime Broker.exe 1036 Runtime Broker.exe 1380 Runtime Broker.exe 3636 Runtime Broker.exe 3908 Runtime Broker.exe 3920 Runtime Broker.exe 2844 Runtime Broker.exe 3484 Runtime Broker.exe 1016 Runtime Broker.exe 3768 Runtime Broker.exe 3684 Runtime Broker.exe 4524 Runtime Broker.exe 4152 Runtime Broker.exe 4928 Runtime Broker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\ProgramData\\Runtime Broker.exe" cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4800 powershell.exe 4800 powershell.exe 2352 powershell.exe 2352 powershell.exe 4956 powershell.exe 4956 powershell.exe 4292 powershell.exe 4292 powershell.exe 3876 cmd.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 3876 cmd.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 4292 powershell.exe Token: SeDebugPrivilege 3876 cmd.exe Token: SeDebugPrivilege 2844 Runtime Broker.exe Token: SeDebugPrivilege 2588 Runtime Broker.exe Token: SeDebugPrivilege 372 Runtime Broker.exe Token: SeDebugPrivilege 2980 Runtime Broker.exe Token: SeDebugPrivilege 1036 Runtime Broker.exe Token: SeDebugPrivilege 1380 Runtime Broker.exe Token: SeDebugPrivilege 3636 Runtime Broker.exe Token: SeDebugPrivilege 3908 Runtime Broker.exe Token: SeDebugPrivilege 3920 Runtime Broker.exe Token: SeDebugPrivilege 2844 Runtime Broker.exe Token: SeDebugPrivilege 3484 Runtime Broker.exe Token: SeDebugPrivilege 1016 Runtime Broker.exe Token: SeDebugPrivilege 3768 Runtime Broker.exe Token: SeDebugPrivilege 3684 Runtime Broker.exe Token: SeDebugPrivilege 4524 Runtime Broker.exe Token: SeDebugPrivilege 4152 Runtime Broker.exe Token: SeDebugPrivilege 4928 Runtime Broker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3876 cmd.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4800 3876 cmd.exe 90 PID 3876 wrote to memory of 4800 3876 cmd.exe 90 PID 3876 wrote to memory of 2352 3876 cmd.exe 93 PID 3876 wrote to memory of 2352 3876 cmd.exe 93 PID 3876 wrote to memory of 4956 3876 cmd.exe 95 PID 3876 wrote to memory of 4956 3876 cmd.exe 95 PID 3876 wrote to memory of 4292 3876 cmd.exe 97 PID 3876 wrote to memory of 4292 3876 cmd.exe 97 PID 3876 wrote to memory of 3680 3876 cmd.exe 99 PID 3876 wrote to memory of 3680 3876 cmd.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cmd.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Runtime Broker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\ProgramData\Runtime Broker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3680
-
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:372
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4152
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD50680a239ba405c1935c687ebdf6d4540
SHA1bf2cc8de357fe1af9888e120e1c139ca2bc77c15
SHA25610db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d
SHA51209ff2d0449404f7b704cb8270ceecfc87d84c42c202a55ce20fb425230d81f5bf8a798c1c52a2a1ed19c599ad8d2f72188c561d734dd79ac70b7973fbd07fc73
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD50093819c829dd30c13746f256efba97f
SHA1f095cbb1d10a54a91d7d341c4098d44973d3ec50
SHA2565f936c252c9ed7d08d4a73b86230d9877173b44c36544f0b24eae3eb38617401
SHA51272aac852de41473494d2263aa44dbabfb1f318f8a21ebdfe080c4a98b9288db07e9641a935d9a640b5e879f28a0560cae53bd4191ac94d315b87746e57e69af2
-
Filesize
944B
MD540ab79d6c729366491090e2efcc5005a
SHA13b3cee1f4dfaaee2835ddee5c814a92b614eb3c3
SHA256aa04b5231b6db0e6d4533b7ca6f569cc59337fe509e7f63927b924db914ae83e
SHA51212cfde5b8be04232984f3119e4d4a4379e387eec236cdf9623cee5fd330c517adc5c3b9e3ba67a13be7c190210c44da4f5db884a8bf7737fd010666ba6b12d03
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82