Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 12:00
Behavioral task
behavioral1
Sample
ратник.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ратник.exe
Resource
win10v2004-20240709-en
General
-
Target
ратник.exe
-
Size
62KB
-
MD5
f5d67f4988d18fb4b52e7de4ad75168d
-
SHA1
b1f3b4d40d3a5e177ec04c478d6a02f85d57e35c
-
SHA256
3c9f38093ef7ca9ff110fdb5cff7fcb4c8eec737536181561e75410a88a9d465
-
SHA512
32223a0e6f50608d992556a4de81f72c3fd62646ea8e340729addfeca02b686dfa450f591c82c2e564d164b62e08a0aaf543dd9c0d3835194d69d279554e79f0
-
SSDEEP
1536:DLxX5T7Oxst3AExTPCObC9+raFgC6lFKJOHhxL:DltcsmEwObCE7EJOHjL
Malware Config
Extracted
xworm
stores-achieved.gl.at.ply.gg:64510
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2532-1-0x0000000000A30000-0x0000000000A46000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2704 powershell.exe 2600 powershell.exe 1692 powershell.exe 2644 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ратник.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ратник.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" ратник.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2704 powershell.exe 2600 powershell.exe 1692 powershell.exe 2644 powershell.exe 1224 chrome.exe 1224 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 2532 ратник.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 2644 powershell.exe Token: SeDebugPrivilege 2532 ратник.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2704 2532 ратник.exe 31 PID 2532 wrote to memory of 2704 2532 ратник.exe 31 PID 2532 wrote to memory of 2704 2532 ратник.exe 31 PID 2532 wrote to memory of 2600 2532 ратник.exe 33 PID 2532 wrote to memory of 2600 2532 ратник.exe 33 PID 2532 wrote to memory of 2600 2532 ратник.exe 33 PID 2532 wrote to memory of 1692 2532 ратник.exe 36 PID 2532 wrote to memory of 1692 2532 ратник.exe 36 PID 2532 wrote to memory of 1692 2532 ратник.exe 36 PID 2532 wrote to memory of 2644 2532 ратник.exe 38 PID 2532 wrote to memory of 2644 2532 ратник.exe 38 PID 2532 wrote to memory of 2644 2532 ратник.exe 38 PID 1224 wrote to memory of 1932 1224 chrome.exe 41 PID 1224 wrote to memory of 1932 1224 chrome.exe 41 PID 1224 wrote to memory of 1932 1224 chrome.exe 41 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 2684 1224 chrome.exe 42 PID 1224 wrote to memory of 464 1224 chrome.exe 43 PID 1224 wrote to memory of 464 1224 chrome.exe 43 PID 1224 wrote to memory of 464 1224 chrome.exe 43 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44 PID 1224 wrote to memory of 580 1224 chrome.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ратник.exe"C:\Users\Admin\AppData\Local\Temp\ратник.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ратник.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ратник.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feefa59758,0x7feefa59768,0x7feefa597782⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:22⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:82⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1456 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:82⤵PID:580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:12⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:12⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1856 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:22⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3160 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1280,i,9416952186357752949,6137643962858121182,131072 /prefetch:82⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD51835d6f34b115216216432d8981f1075
SHA1c1b0b19757270ba8f1aa820b5fad0535b0e6ffd0
SHA2568533ead012859ed78384776759c80543fb8f3456ef9fc9dbf7347fbf4f4eb520
SHA512702aa6160d99d1d99a6c1324a1e9b1a8eb039117989bbae37d6e4a8c21bbf1dcc3fa2b9918d725af63a0cb862702fbf66bf66ee577a2b3ce6d418aba782e1083
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
308KB
MD572716d45e4b788ef4fb32b65d9272a78
SHA15dfb0c97c056753777a3a84760355ba4f1a8cf7c
SHA25663a34996730ced7c3110cf667a732cf3ab1a0ef9d2a66adb5113da48ecc623cd
SHA5123f8f86ab486280f79f49a47fba4a735052b915d95ead11a7479722ccda48e50a9287a4c415f2c5824d2a6ace768e78692dc9f52801dcd7887a13b1f32c82cf5e
-
Filesize
308KB
MD5350cd67be0398e0a3ceae164e1a4f555
SHA15916a6383a3cfbd49b187a301b7b32ac5780a6c9
SHA25690bf3b558d6d449e4d6eeff9cad373ef58d4de6887d4bc65b15c24e8d39da49e
SHA5127209320f6e9adb4789f51a50659cc9c79af9b6c3a767e2052db4063628ef7581ae5ac00a09d90f5046d11d68e129a1171d56c60a38081f1393b0b44783369a88
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d740a927c7816668fa41e96e505620ad
SHA10501caf23c93ff9d4ab4e23982689062e6c6dffe
SHA2563ba5cecd3cb619ad52357949574d86780869258038333b682cb488f4c0223700
SHA5128589be7f8b7b315ce9ffd86878acefdeefd6e5ade0ab08c6d050069a65aee7ea5e6359fef6eecd50ebc8844d91a865d0a6b959dce9481c7465edd84a81ebc53a