Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/08/2024, 05:25
Behavioral task
behavioral1
Sample
для дискорда подцветка.exe
Resource
win11-20240802-en
General
-
Target
для дискорда подцветка.exe
-
Size
74KB
-
MD5
1fff6319630c8840455856ccfc3fab6b
-
SHA1
8d23d47c005cb8e59da31d6f5ceacdafda3a2ea3
-
SHA256
f58fa175e86798fe2448f5505e6593f4970d584cb6a59c2e35ae3508053f99b5
-
SHA512
32dcf2abef8f015bf9b8dbbbfdeddab47aef4ef062c6e812e83f6e363a701bc2296727f7971c7eebd4cce2023d14f092612ba6a4eaa8c40d0ad841e9d860943b
-
SSDEEP
1536:ZRhuDQx5Y55vNUWmjS9HnxbZgQz6vOcb9XjIdhd:jwsq5v+WNFnxbZmOcbFjqd
Malware Config
Extracted
xworm
127.0.0.1:8848
localhost:8848
domain-vote.gl.at.ply.gg:8848
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1932-1-0x0000000000260000-0x0000000000278000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2528 powershell.exe 996 powershell.exe 2188 powershell.exe 1540 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk для дискорда подцветка.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk для дискорда подцветка.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" для дискорда подцветка.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2528 powershell.exe 2528 powershell.exe 996 powershell.exe 996 powershell.exe 2188 powershell.exe 2188 powershell.exe 1540 powershell.exe 1540 powershell.exe 1932 для дискорда подцветка.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1932 для дискорда подцветка.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 996 powershell.exe Token: SeDebugPrivilege 2188 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 1932 для дискорда подцветка.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1932 для дискорда подцветка.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2528 1932 для дискорда подцветка.exe 83 PID 1932 wrote to memory of 2528 1932 для дискорда подцветка.exe 83 PID 1932 wrote to memory of 996 1932 для дискорда подцветка.exe 85 PID 1932 wrote to memory of 996 1932 для дискорда подцветка.exe 85 PID 1932 wrote to memory of 2188 1932 для дискорда подцветка.exe 87 PID 1932 wrote to memory of 2188 1932 для дискорда подцветка.exe 87 PID 1932 wrote to memory of 1540 1932 для дискорда подцветка.exe 89 PID 1932 wrote to memory of 1540 1932 для дискорда подцветка.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\для дискорда подцветка.exe"C:\Users\Admin\AppData\Local\Temp\для дискорда подцветка.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\для дискорда подцветка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'для дискорда подцветка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
944B
MD564497dba662bee5d7ae7a3c76a72ed88
SHA1edc027042b9983f13d074ba9eed8b78e55e4152e
SHA256ca69ebbd2c9c185f0647fb2122d7a26e7d23af06a1950fb25ac327d869687b47
SHA51225da69ec86ba0df6c7da60f722cc2919c59c91f2bb03137e0e87771936e5271522d48eef98030a0da41f7a707d82221d35fb016f8bb9a294e87be114adbe3522
-
Filesize
944B
MD5707dbf0d5eb0cd5a2f323eb073128dd5
SHA1e4daf9ffbda702002fa90376c88e1c36780d7576
SHA25606954e4baf5389661f6696d547662eed4a6772104c8d8786574eeba48958204f
SHA5122d025fa0c4a18df2c11a212aae15e3017dea13eddd11c79a48949e4e3bafa450555329b54bde8674b57c5c3b99af2f66c3670f635261889420a918b7d3a58152
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82