Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/06/2024, 14:41
240623-r2vtqsvbqg 1023/06/2024, 14:41
240623-r2laasybkp 1023/06/2024, 12:34
240623-prw8pszgqg 10Analysis
-
max time kernel
1045s -
max time network
1022s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/06/2024, 14:41
Behavioral task
behavioral1
Sample
Recycle Bin.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Recycle Bin.exe
Resource
win10v2004-20240508-en
General
-
Target
Recycle Bin.exe
-
Size
66KB
-
MD5
0680a239ba405c1935c687ebdf6d4540
-
SHA1
bf2cc8de357fe1af9888e120e1c139ca2bc77c15
-
SHA256
10db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d
-
SHA512
09ff2d0449404f7b704cb8270ceecfc87d84c42c202a55ce20fb425230d81f5bf8a798c1c52a2a1ed19c599ad8d2f72188c561d734dd79ac70b7973fbd07fc73
-
SSDEEP
1536:44Sw2KfDxiZcy2fdbdFSQ37E6vObaKjG:4OL1yGdbdF5ZObPG
Malware Config
Extracted
xworm
medical-m.gl.at.ply.gg:28857
-
Install_directory
%ProgramData%
-
install_file
Runtime Broker.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/2640-1-0x0000000000FA0000-0x0000000000FB6000-memory.dmp family_xworm behavioral2/files/0x000c0000000233f6-59.dat family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4564 powershell.exe 1080 powershell.exe 4960 powershell.exe 4856 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Recycle Bin.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk Recycle Bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk Recycle Bin.exe -
Executes dropped EXE 17 IoCs
pid Process 744 Runtime Broker.exe 3652 Runtime Broker.exe 5072 Runtime Broker.exe 3612 Runtime Broker.exe 2792 Runtime Broker.exe 4172 Runtime Broker.exe 5088 Runtime Broker.exe 3876 Runtime Broker.exe 3872 Runtime Broker.exe 3136 Runtime Broker.exe 4004 Runtime Broker.exe 1444 Runtime Broker.exe 2360 Runtime Broker.exe 2556 Runtime Broker.exe 2000 Runtime Broker.exe 4376 Runtime Broker.exe 3944 Runtime Broker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\ProgramData\\Runtime Broker.exe" Recycle Bin.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4564 powershell.exe 4564 powershell.exe 1080 powershell.exe 1080 powershell.exe 4960 powershell.exe 4960 powershell.exe 4856 powershell.exe 4856 powershell.exe 2640 Recycle Bin.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2640 Recycle Bin.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4856 powershell.exe Token: SeDebugPrivilege 2640 Recycle Bin.exe Token: SeDebugPrivilege 744 Runtime Broker.exe Token: SeDebugPrivilege 3652 Runtime Broker.exe Token: SeDebugPrivilege 5072 Runtime Broker.exe Token: SeDebugPrivilege 3612 Runtime Broker.exe Token: SeDebugPrivilege 2792 Runtime Broker.exe Token: SeDebugPrivilege 4172 Runtime Broker.exe Token: SeDebugPrivilege 5088 Runtime Broker.exe Token: SeDebugPrivilege 3876 Runtime Broker.exe Token: SeDebugPrivilege 3872 Runtime Broker.exe Token: SeDebugPrivilege 3136 Runtime Broker.exe Token: SeDebugPrivilege 4004 Runtime Broker.exe Token: SeDebugPrivilege 1444 Runtime Broker.exe Token: SeDebugPrivilege 2360 Runtime Broker.exe Token: SeDebugPrivilege 2556 Runtime Broker.exe Token: SeDebugPrivilege 2000 Runtime Broker.exe Token: SeDebugPrivilege 4376 Runtime Broker.exe Token: SeDebugPrivilege 3944 Runtime Broker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2640 Recycle Bin.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4564 2640 Recycle Bin.exe 82 PID 2640 wrote to memory of 4564 2640 Recycle Bin.exe 82 PID 2640 wrote to memory of 1080 2640 Recycle Bin.exe 84 PID 2640 wrote to memory of 1080 2640 Recycle Bin.exe 84 PID 2640 wrote to memory of 4960 2640 Recycle Bin.exe 86 PID 2640 wrote to memory of 4960 2640 Recycle Bin.exe 86 PID 2640 wrote to memory of 4856 2640 Recycle Bin.exe 88 PID 2640 wrote to memory of 4856 2640 Recycle Bin.exe 88 PID 2640 wrote to memory of 5044 2640 Recycle Bin.exe 90 PID 2640 wrote to memory of 5044 2640 Recycle Bin.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recycle Bin.exe"C:\Users\Admin\AppData\Local\Temp\Recycle Bin.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Recycle Bin.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Recycle Bin.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Runtime Broker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\ProgramData\Runtime Broker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5044
-
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\ProgramData\Runtime Broker.exe"C:\ProgramData\Runtime Broker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD50680a239ba405c1935c687ebdf6d4540
SHA1bf2cc8de357fe1af9888e120e1c139ca2bc77c15
SHA25610db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d
SHA51209ff2d0449404f7b704cb8270ceecfc87d84c42c202a55ce20fb425230d81f5bf8a798c1c52a2a1ed19c599ad8d2f72188c561d734dd79ac70b7973fbd07fc73
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5b4b6d4cc52b5a3a71149b1f33d94d5de
SHA197d3dbdd24919eab70e3b14c68797cefc07e90dd
SHA256da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe
SHA512fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af
-
Filesize
944B
MD59bc110200117a3752313ca2acaf8a9e1
SHA1fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA256c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
SHA5121f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82