Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XClient.exe
windows10-1703-x64
XClient.exe
windows7-x64
XClient.exe
windows10-1703-x64
XClient.exe
windows10-2004-x64
XClient.exe
windows11-21h2-x64
XClient.exe
macos-10.15-amd64
1XClient.exe
macos-10.15-amd64
1XClient.exe
ubuntu-24.04-amd64
XClient.exe
debian-12-armhf
XClient.exe
debian-12-mipsel
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
XClient.exe
ubuntu-18.04-amd64
XClient.exe
ubuntu-20.04-amd64
XClient.exe
ubuntu-22.04-amd64
XClient.exe
ubuntu-24.04-amd64
Analysis
-
max time kernel
31s -
max time network
32s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01/08/2024, 20:40
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
debian12-mipsel-20240729-en
Behavioral task
behavioral11
Sample
XClient.exe
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral12
Sample
XClient.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral13
Sample
XClient.exe
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral14
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral15
Sample
XClient.exe
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral16
Sample
XClient.exe
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral17
Sample
XClient.exe
Resource
ubuntu2404-amd64-20240523-en
Errors
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/908-1-0x0000000000230000-0x000000000024A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1588 powershell.exe 1020 powershell.exe 4296 powershell.exe 3492 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1588 powershell.exe 1588 powershell.exe 1588 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 4296 powershell.exe 4296 powershell.exe 4296 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 908 XClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 908 XClient.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeIncreaseQuotaPrivilege 1588 powershell.exe Token: SeSecurityPrivilege 1588 powershell.exe Token: SeTakeOwnershipPrivilege 1588 powershell.exe Token: SeLoadDriverPrivilege 1588 powershell.exe Token: SeSystemProfilePrivilege 1588 powershell.exe Token: SeSystemtimePrivilege 1588 powershell.exe Token: SeProfSingleProcessPrivilege 1588 powershell.exe Token: SeIncBasePriorityPrivilege 1588 powershell.exe Token: SeCreatePagefilePrivilege 1588 powershell.exe Token: SeBackupPrivilege 1588 powershell.exe Token: SeRestorePrivilege 1588 powershell.exe Token: SeShutdownPrivilege 1588 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeSystemEnvironmentPrivilege 1588 powershell.exe Token: SeRemoteShutdownPrivilege 1588 powershell.exe Token: SeUndockPrivilege 1588 powershell.exe Token: SeManageVolumePrivilege 1588 powershell.exe Token: 33 1588 powershell.exe Token: 34 1588 powershell.exe Token: 35 1588 powershell.exe Token: 36 1588 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeIncreaseQuotaPrivilege 4296 powershell.exe Token: SeSecurityPrivilege 4296 powershell.exe Token: SeTakeOwnershipPrivilege 4296 powershell.exe Token: SeLoadDriverPrivilege 4296 powershell.exe Token: SeSystemProfilePrivilege 4296 powershell.exe Token: SeSystemtimePrivilege 4296 powershell.exe Token: SeProfSingleProcessPrivilege 4296 powershell.exe Token: SeIncBasePriorityPrivilege 4296 powershell.exe Token: SeCreatePagefilePrivilege 4296 powershell.exe Token: SeBackupPrivilege 4296 powershell.exe Token: SeRestorePrivilege 4296 powershell.exe Token: SeShutdownPrivilege 4296 powershell.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeSystemEnvironmentPrivilege 4296 powershell.exe Token: SeRemoteShutdownPrivilege 4296 powershell.exe Token: SeUndockPrivilege 4296 powershell.exe Token: SeManageVolumePrivilege 4296 powershell.exe Token: 33 4296 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 908 XClient.exe 700 LogonUI.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 908 wrote to memory of 1588 908 XClient.exe 72 PID 908 wrote to memory of 1588 908 XClient.exe 72 PID 908 wrote to memory of 1020 908 XClient.exe 75 PID 908 wrote to memory of 1020 908 XClient.exe 75 PID 908 wrote to memory of 4296 908 XClient.exe 77 PID 908 wrote to memory of 4296 908 XClient.exe 77 PID 908 wrote to memory of 3492 908 XClient.exe 79 PID 908 wrote to memory of 3492 908 XClient.exe 79 PID 908 wrote to memory of 4140 908 XClient.exe 82 PID 908 wrote to memory of 4140 908 XClient.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 02⤵PID:4140
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aee055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD5de53b4ac0cfdd71568aa63df48cf3be6
SHA1685c8a396ff2e1c62dc134190536a3d738200ae7
SHA2561517f2d73a4d09821409ba4a3b51a1d96506039028db4c871e4795b57dfc0cac
SHA512dbad0cfde69f0796a4dbdfd026971efc8ebd3189c32eb40294364285417a8632d9da01fceb4fc4ece30e22714002fb1daf3f3f3f8bcd5c6755f3a103e8b1d6ae
-
Filesize
1KB
MD5faa21d72b439ecb4fe7b8acb2af8474b
SHA19a201c045a7ec2df06f1386b081e3871df2eef56
SHA2562021b841de397f3a689dfab1ac6e7c10d4e015043bb715200414feb9bd323fb3
SHA5126c309dc4defe55582c3fd51b65a4b0deed0fe94fb7a70fb969a9179fb036284aff133a28e1d3c2519f208de1f333197e856aab0802686ce6e061472e03e2ebbb
-
Filesize
1KB
MD5c4e4aa463e374d2e64f4f87380f27576
SHA1424726631656054768f0670928e4cbe2e4be2505
SHA256b4e0d3b6bce93242d1fdc5883d0fd35c278c0b46eba1120628e2c558d438b954
SHA512e218cca407fc10240ee316f7e85d00d2556bed906f76ab95309d4b3a2f2fbda0ce15737bc4c5feb19c7f0379e3fd82aebda6176bfcef1c3193604adc4ff6e0cb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a