Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ChromeX.exe

windows7-x64

10

ChromeX.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 02:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ChromeX.exe

  • Size

    194KB

  • MD5

    a1e62820b5ef69092346f3d9db6fd9ac

  • SHA1

    ac2ef78ee68befd3cf26ca87d9e8e6311796e908

  • SHA256

    827d6cec5db8ba1d6465bf99d1565259a96804840964aed7e2de4594b482b955

  • SHA512

    3e4358a010c3ea67151529a619981d92ca2e43145d8928835b27562d4ec7fa480bf1b008fe0a826997a0528f7526eaf08669b1de00655293a47bef28052ee88f

  • SSDEEP

    3072:O6Ok77/lR+b+rAzOnXTBg4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvU:0k77/yb+sqBggVqwlL

Score
10/10
xwormevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

downloads-pumps.gl.at.ply.gg:42186

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromeX.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromeX.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ChromeX.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ChromeX.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4052
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:736
    • C:\Windows\Explorer.EXE
      "C:\Windows\Explorer.EXE"
      2⤵
        PID:548
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:516
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1772
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:3980
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:912
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3156
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3916
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4332
              • C:\Windows\system32\dwm.exe
                "dwm.exe"
                1⤵
                  PID:2556
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2040
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4148

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                      Filesize

                      471B

                      MD5

                      618f6dc0d63e9f881dc1107a7e56dbc7

                      SHA1

                      12534c7b00b40dc2ae76482c2a7bd8fad3329cd5

                      SHA256

                      b195d2c810c2db1349760500305f49e17ebeb47825aeaaf41e95bd11e2fdba86

                      SHA512

                      2c33661df07eaea6f9b24c53699fcaa0dc14e2c56f8b91766204a1cb7320c9fdc53c04f674ffb1e4d54c659ef2dc6406aa3a98d45d2f6416101161ab4a62a037

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                      Filesize

                      420B

                      MD5

                      11c07996ee73afc419df29293ccd397a

                      SHA1

                      d28ccf58180b71cd56e2d0e1b25e46de69787996

                      SHA256

                      ed5b18cbbf823fe0724ac9ef17e31444ebe26b0d43476f28dd51e3ab3448631f

                      SHA512

                      8ce6f886b5d1c4d8b132151e8805c7598ac92bbc3c71cac4b66f5867a0e5af27847c1ba7540444c3f8afc8a9188454b9a0451584dac4eb50803d720e825a81fb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      77d622bb1a5b250869a3238b9bc1402b

                      SHA1

                      d47f4003c2554b9dfc4c16f22460b331886b191b

                      SHA256

                      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                      SHA512

                      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      ce4540390cc4841c8973eb5a3e9f4f7d

                      SHA1

                      2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

                      SHA256

                      e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

                      SHA512

                      2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      ba169f4dcbbf147fe78ef0061a95e83b

                      SHA1

                      92a571a6eef49fff666e0f62a3545bcd1cdcda67

                      SHA256

                      5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                      SHA512

                      8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsuhtdtu.bp2.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • memory/3336-14-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/3336-2-0x00000220C0C90000-0x00000220C0CB2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/3336-13-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/3336-12-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/3336-17-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4148-81-0x000001E6FD610000-0x000001E6FD630000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4148-111-0x000001E6FD5D0000-0x000001E6FD5F0000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4148-112-0x000001E6FD9E0000-0x000001E6FDA00000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4148-76-0x000001E6FC500000-0x000001E6FC600000-memory.dmp

                      Filesize

                      1024KB

                      Download

                    • memory/4148-78-0x000001E6FC500000-0x000001E6FC600000-memory.dmp

                      Filesize

                      1024KB

                      Download

                    • memory/4332-75-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4648-56-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4648-0-0x00007FF95EB03000-0x00007FF95EB05000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4648-62-0x000000001D640000-0x000000001D64C000-memory.dmp

                      Filesize

                      48KB

                      Download

                    • memory/4648-61-0x0000000002D90000-0x0000000002D9E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/4648-59-0x00007FF95EB00000-0x00007FF95F5C1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4648-58-0x000000001D520000-0x000000001D52C000-memory.dmp

                      Filesize

                      48KB

                      Download

                    • memory/4648-57-0x00007FF95EB03000-0x00007FF95EB05000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4648-1-0x0000000000B40000-0x0000000000B76000-memory.dmp

                      Filesize

                      216KB

                      Download