Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClient.exe

windows10-1703-x64

XClient.exe

windows7-x64

XClient.exe

windows10-1703-x64

XClient.exe

windows10-2004-x64

XClient.exe

windows11-21h2-x64

Analysis

  • max time kernel
    254s
  • max time network
    255s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/08/2024, 10:22

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    283KB

  • MD5

    94d7570a4d6becf9ccccac918fc7a525

  • SHA1

    8e9fa909a7f38b1f4481ee880340c96aa03a9a84

  • SHA256

    6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df

  • SHA512

    d97b0b2c758e3288ffbacf1111b621f0530ad152830b17795a8734e4d30cd85c5578d94983f6668222028e45095582a05a41033df0bf1061fb18124fe7fa8e7f

  • SSDEEP

    3072:c43Cklb4wOyopUd87kREhYyZxbHrR6Y7zjokEtNaaayMakxiJ+UZeQnjm9sjSwkm:bpbVoA8oKhsrx8iJZeQiWsVCA2aAN0F

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

hard-tyler.gl.at.ply.gg:27490

Attributes
  • Install_directory

    %Temp%

  • install_file

    systemprocess.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4476
    • C:\Windows\SYSTEM32\shutdown.exe
      shutdown.exe /f /s /t 0
      2⤵
        PID:3576
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4116
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2932
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2972
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1044
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4904
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3204
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aff055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4052
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
        PID:420
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:3308

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          3KB

          MD5

          8592ba100a78835a6b94d5949e13dfc1

          SHA1

          63e901200ab9a57c7dd4c078d7f75dcd3b357020

          SHA256

          fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

          SHA512

          87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml
          Filesize

          74KB

          MD5

          d4fc49dc14f63895d997fa4940f24378

          SHA1

          3efb1437a7c5e46034147cbbc8db017c69d02c31

          SHA256

          853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

          SHA512

          cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          1KB

          MD5

          6ccf7dc060a75cb33a47ac144fe87c0e

          SHA1

          42ca159603e20461fcf0972f0eba1afb648fd048

          SHA256

          4870e6eeb0b4db5c852576b58a566b9120b801dfa200077ab11f1a630d70f0ab

          SHA512

          a38f0b793d91f8d27266afd311324261244a78c8c2e4bd9e0f58aded5b2e157bf9e089eab9c10d48fdfa5ec9e18f5554874630b232c3957e1a214a1250d2a521

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          1KB

          MD5

          db687dd28fc6f4caec38bc7106500446

          SHA1

          50f8ee78283ab516ec563587a66bbbf3b4a0e612

          SHA256

          6112d22d06f8d5ff04ebc6ee59003e379464eb5e3f2f30abcd21e45d5fe29f52

          SHA512

          615db4a2932f0bd8861bd79a8926fc5a2cb0ddc227198b23cf8b7eb8d3c9f84c919feb2b3a175958a9771a1854ad1369580c085046bace6a995fe564683f6f45

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          1KB

          MD5

          4401aad4b31d8dc74cc6959a8ea28e3c

          SHA1

          90b928b3771494fcf57e04d3a8ae721a250bdda6

          SHA256

          931f8945d61d980886be54a86d336a672b3d5a04efef4f48a9de2171882fe047

          SHA512

          525793469f20312853f9a248206a50df75c8326cb17dd452922e4664c9757a58bc38d122961ab4e142b8324f6777ea3bbe58c63a73a756fbe763afb7f7fb384a

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WN3ARXN2\crypto-js.min[1].js
          Filesize

          46KB

          MD5

          cf3402d7483b127ded4069d651ea4a22

          SHA1

          bde186152457cacf9c35477b5bdda5bcb56b1f45

          SHA256

          eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc

          SHA512

          9ce42ebc3f672a2aefc4376f43d38ca9ed9d81aa5b3c1eef60032bcc98a1c399be68d71fd1d5f9de6e98c4ce0b800f6ef1ef5e83d417fbffa63eef2408da55d8

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2X206TA8\guns-solid[1].svg
          Filesize

          732B

          MD5

          48817a08ba7e68c843c044f272f9f6f7

          SHA1

          ac3a03887ef169327cca4fed5632453611da39a8

          SHA256

          e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4

          SHA512

          a3d4296d8a408af9e412fdb60554f63bf2005bc0eb3a863f7a47f2bc9f311e0a5672b68e318c0600cb099b3c64f6037a02c97e875b9fd91808d336ca8a7e50ef

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\WX2JLRZY\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fj3j44nv.zru.ps1
          Filesize

          1B

          MD5

          c4ca4238a0b923820dcc509a6f75849b

          SHA1

          356a192b7913b04c54574d18c28d46e6395428ab

          SHA256

          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

          SHA512

          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          Download Submit

        • memory/1044-233-0x0000028B84080000-0x0000028B84180000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1044-232-0x0000028B84080000-0x0000028B84180000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1688-10-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/1688-51-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/1688-13-0x000001AD5F2A0000-0x000001AD5F316000-memory.dmp

          Filesize

          472KB

          Download

        • memory/1688-9-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/1688-8-0x000001AD5F0F0000-0x000001AD5F112000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1688-7-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/3700-185-0x00007FF8BAF83000-0x00007FF8BAF84000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3700-186-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/3700-187-0x000000001C070000-0x000000001C07C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/3700-656-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/3700-0-0x00007FF8BAF83000-0x00007FF8BAF84000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3700-2-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/3700-1-0x0000000000790000-0x00000000007DC000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4116-205-0x000001C39E820000-0x000001C39E830000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4116-575-0x000001C3A54D0000-0x000001C3A54D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4116-574-0x000001C3A4CF0000-0x000001C3A4CF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4116-224-0x000001C39D7E0000-0x000001C39D7E2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4116-189-0x000001C39E720000-0x000001C39E730000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4904-251-0x000002252FE00000-0x000002252FF00000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/4904-299-0x0000022571870000-0x0000022571872000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4904-297-0x0000022571850000-0x0000022571852000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4904-307-0x0000022572160000-0x0000022572162000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4904-242-0x000002252F4F0000-0x000002252F4F2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4904-365-0x000002252FE00000-0x000002252FF00000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/4904-247-0x000002252F540000-0x000002252F542000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4904-245-0x000002252F520000-0x000002252F522000-memory.dmp

          Filesize

          8KB

          Download