Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    989s
  • max time network
    883s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/08/2024, 10:04

General

  • Target

    Steam.exe

  • Size

    51KB

  • MD5

    eb794f3819b32c9fbc747309bb04cd68

  • SHA1

    a6c24bfb6c2ea4cdf10f0f54c0a4e8ac0380beb3

  • SHA256

    e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67

  • SHA512

    0b6cf31c799513b4e0f5ac21180cc7a26451fc54504f03ace353a5a8c598885c594b3375e990ac442e08ffaa1f3e9692cbf6dfb8c035b4380497cefd57288aaf

  • SSDEEP

    768:juMMmVn76G3rspEacCIQgttZX+2V2ltnq7oTmggkbm1t+tuXSWCalOIhu//t/:SMDnv7sKEIHLXyBqCmjkbmn/weOImF/

Score
10/10

Malware Config

Extracted

Family

xworm

C2

tree-cleaning.gl.at.ply.gg:33027

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Steam.exe
    "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    PID:2752
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4148
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4672
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:344
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1424
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4572
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3656
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2620
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U8DBR88G\crypto-js.min[1].js

    Filesize

    46KB

    MD5

    cf3402d7483b127ded4069d651ea4a22

    SHA1

    bde186152457cacf9c35477b5bdda5bcb56b1f45

    SHA256

    eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc

    SHA512

    9ce42ebc3f672a2aefc4376f43d38ca9ed9d81aa5b3c1eef60032bcc98a1c399be68d71fd1d5f9de6e98c4ce0b800f6ef1ef5e83d417fbffa63eef2408da55d8

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\K978RKDB\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RXSV0UGS\guns-solid[1].svg

    Filesize

    732B

    MD5

    48817a08ba7e68c843c044f272f9f6f7

    SHA1

    ac3a03887ef169327cca4fed5632453611da39a8

    SHA256

    e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4

    SHA512

    a3d4296d8a408af9e412fdb60554f63bf2005bc0eb3a863f7a47f2bc9f311e0a5672b68e318c0600cb099b3c64f6037a02c97e875b9fd91808d336ca8a7e50ef

  • memory/1424-48-0x0000028EA2D40000-0x0000028EA2E40000-memory.dmp

    Filesize

    1024KB

  • memory/2752-3-0x00007FF8747A0000-0x00007FF87518C000-memory.dmp

    Filesize

    9.9MB

  • memory/2752-484-0x00007FF8747A0000-0x00007FF87518C000-memory.dmp

    Filesize

    9.9MB

  • memory/2752-2-0x00007FF8747A0000-0x00007FF87518C000-memory.dmp

    Filesize

    9.9MB

  • memory/2752-1-0x00007FF8747A3000-0x00007FF8747A4000-memory.dmp

    Filesize

    4KB

  • memory/2752-0-0x0000000000D00000-0x0000000000D14000-memory.dmp

    Filesize

    80KB

  • memory/4148-39-0x000001E3F71E0000-0x000001E3F71E2000-memory.dmp

    Filesize

    8KB

  • memory/4148-20-0x000001E3F8120000-0x000001E3F8130000-memory.dmp

    Filesize

    64KB

  • memory/4148-4-0x000001E3F8020000-0x000001E3F8030000-memory.dmp

    Filesize

    64KB

  • memory/4572-223-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-238-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-118-0x00000164FE850000-0x00000164FE852000-memory.dmp

    Filesize

    8KB

  • memory/4572-163-0x00000164FEED0000-0x00000164FEFD0000-memory.dmp

    Filesize

    1024KB

  • memory/4572-220-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-115-0x00000164FDFF0000-0x00000164FDFF2000-memory.dmp

    Filesize

    8KB

  • memory/4572-224-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-226-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-229-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-231-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-233-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-234-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-239-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-127-0x00000164FEC90000-0x00000164FEC92000-memory.dmp

    Filesize

    8KB

  • memory/4572-237-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-236-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-235-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-232-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-230-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-225-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-222-0x00000164EBED0000-0x00000164EBEE0000-memory.dmp

    Filesize

    64KB

  • memory/4572-63-0x00000164EC5A0000-0x00000164EC6A0000-memory.dmp

    Filesize

    1024KB

  • memory/4572-60-0x00000164EC210000-0x00000164EC212000-memory.dmp

    Filesize

    8KB

  • memory/4572-55-0x00000164EBEC0000-0x00000164EBEC2000-memory.dmp

    Filesize

    8KB

  • memory/4572-58-0x00000164EBEF0000-0x00000164EBEF2000-memory.dmp

    Filesize

    8KB