Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 16:26

General

  • Target

    WizWorm (Modified XWorm)/WizWorm.exe

  • Size

    99KB

  • MD5

    a9b00ac5f9c02e540c61381a5fae62c3

  • SHA1

    273e272cc73d519c5cba2839de4e6043fd8977b0

  • SHA256

    3ad4aa1921b844c635bbeef2a492a3d1ff134af6a38a1c31d7d264da3e192a38

  • SHA512

    924316a6cd0b91617d23010cc031ccbc1a99c4d72f9199fb3215d68ae6ea6cc9c3a4888777bf4c72d920d940e68b828a4ede75c299a5f7b7f804250cea4ae570

  • SSDEEP

    1536:n1vP5KmktoR0wQNB+QC+ZMh/uFPah6x2C4bFwOL/n6106/Y7FwoOLTrXatVSFayK:VxLCLN06PahfLbFZL/6PWZOL6GPPy

Malware Config

Extracted

Family

xworm

C2

auto-london.gl.at.ply.gg:51655

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    NigNigRat.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizWorm (Modified XWorm)\WizWorm.exe
    "C:\Users\Admin\AppData\Local\Temp\WizWorm (Modified XWorm)\WizWorm.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WizWorm (Modified XWorm)\WizWorm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizWorm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WizWorm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    bd5940f08d0be56e65e5f2aaf47c538e

    SHA1

    d7e31b87866e5e383ab5499da64aba50f03e8443

    SHA256

    2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

    SHA512

    c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    c1b0a9f26c3e1786191e94e419f1fbf9

    SHA1

    7f3492f4ec2d93e164f43fe2606b53edcffd8926

    SHA256

    796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

    SHA512

    fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgqsssto.klh.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2580-0-0x00007FFDFE603000-0x00007FFDFE605000-memory.dmp

    Filesize

    8KB

  • memory/2580-1-0x0000000000C30000-0x0000000000C4E000-memory.dmp

    Filesize

    120KB

  • memory/2580-2-0x00007FFDFE600000-0x00007FFDFF0C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4688-3-0x00000196422E0000-0x0000019642302000-memory.dmp

    Filesize

    136KB

  • memory/4688-9-0x00007FFDFE600000-0x00007FFDFF0C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4688-14-0x00007FFDFE600000-0x00007FFDFF0C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4688-15-0x00007FFDFE600000-0x00007FFDFF0C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4688-18-0x00007FFDFE600000-0x00007FFDFF0C1000-memory.dmp

    Filesize

    10.8MB