Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    About_me_Logan.pptx.bat.exe

  • Size

    495KB

  • Sample

    240710-ddwt8ssfln

  • MD5

    ddd1a363eeb560703c3321de9c99a7da

  • SHA1

    31e70586ce843492c3cf6636388190702ba32792

  • SHA256

    6120dc9c6c98279da2699c07a30bf81badf6e9f256fb0e583d1a12f58a0fee98

  • SHA512

    080844fdc6a3f4a7606547cdf7e571e81848c6d912d3d66cdd25e553a677c44f61c5ac5e7c974ce7e41fdbf8fd27c878145ac32e68615c7b71faf38094e93ec1

  • SSDEEP

    12288:ACQjgAtAHM+vetZxF5EWry8AJGy0UQHPB7bypjAlkD:A5ZWs+OZVEWry8AFQH1bCjAly

Malware Config

Extracted

Family

xworm

C2

outdoor-marriott.gl.at.ply.gg:3441

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

Targets

    • Target

      About_me_Logan.pptx.bat.exe

    • Size

      495KB

    • MD5

      ddd1a363eeb560703c3321de9c99a7da

    • SHA1

      31e70586ce843492c3cf6636388190702ba32792

    • SHA256

      6120dc9c6c98279da2699c07a30bf81badf6e9f256fb0e583d1a12f58a0fee98

    • SHA512

      080844fdc6a3f4a7606547cdf7e571e81848c6d912d3d66cdd25e553a677c44f61c5ac5e7c974ce7e41fdbf8fd27c878145ac32e68615c7b71faf38094e93ec1

    • SSDEEP

      12288:ACQjgAtAHM+vetZxF5EWry8AJGy0UQHPB7bypjAlkD:A5ZWs+OZVEWry8AFQH1bCjAly

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.