Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

hdgskhajdas.exe

windows7-x64

10

hdgskhajdas.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    209s
  • max time network
    205s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hdgskhajdas.exe

  • Size

    76KB

  • MD5

    aa8bcf0e83ab2a2af7ce39875fd20fbe

  • SHA1

    c55ad41b192f90ca53a42ecf04db5765313ac87d

  • SHA256

    83987f4b73cdd5039147a00ee7340b05edf3d672d07e848085ec29a328173585

  • SHA512

    9dc8b2958fb7fb42a7843ad4d1a7a9c08f3e17f12c1b44ffb3b2a2a07d49d8389cbcc3ff3bbd6a52c95d4856e1721c66ceffc2ca22473f373ff070cc21ed6700

  • SSDEEP

    1536:Fi2fm7411REAwgc2/HbYftO9Y7bIKkYY+qdko76b+O1NdP0hX:DE/J6y7bIKk1Pdkp+OTdY

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.21:4825

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    EpicGamesLauncher.exe

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\hdgskhajdas.exe
    "C:\Users\Admin\AppData\Local\Temp\hdgskhajdas.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hdgskhajdas.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'hdgskhajdas.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\EpicGamesLauncher.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3024
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'EpicGamesLauncher.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:748
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "EpicGamesLauncher" /tr "C:\ProgramData\EpicGamesLauncher.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2964
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {85A1DF62-83CC-4F22-BFB8-ACA56AC75D7E} S-1-5-21-2257386474-3982792636-3902186748-1000:CTBHAMHL\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\ProgramData\EpicGamesLauncher.exe
      C:\ProgramData\EpicGamesLauncher.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
    • C:\ProgramData\EpicGamesLauncher.exe
      C:\ProgramData\EpicGamesLauncher.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2364
    • C:\ProgramData\EpicGamesLauncher.exe
      C:\ProgramData\EpicGamesLauncher.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\ProgramData\EpicGamesLauncher.exe
      C:\ProgramData\EpicGamesLauncher.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\EpicGamesLauncher.exe
    Filesize

    76KB

    MD5

    aa8bcf0e83ab2a2af7ce39875fd20fbe

    SHA1

    c55ad41b192f90ca53a42ecf04db5765313ac87d

    SHA256

    83987f4b73cdd5039147a00ee7340b05edf3d672d07e848085ec29a328173585

    SHA512

    9dc8b2958fb7fb42a7843ad4d1a7a9c08f3e17f12c1b44ffb3b2a2a07d49d8389cbcc3ff3bbd6a52c95d4856e1721c66ceffc2ca22473f373ff070cc21ed6700

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U9OAZWFXUY2ELYNBLKEK.temp
    Filesize

    7KB

    MD5

    03f031330820616d2bf2c6868b0f927f

    SHA1

    66cc43403c07c452c6c237a284cca7f6bfcd70fe

    SHA256

    0f4a2614e6dbcc6a16f78035f4cd7eb3370bf19570bc8a8a57bfbc5db601cee6

    SHA512

    f30e390f2d0d987833a92d47c20b5f1783358db0dcfa1ff6efa142cc227462cb64e22cd427df8a5159ba6d5b6b5b7db86771567647e88d1f04a8934ae989087d

    Download Submit

  • memory/1096-15-0x0000000001D90000-0x0000000001D98000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1096-14-0x000000001B760000-0x000000001BA42000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2004-36-0x0000000000270000-0x0000000000280000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2004-34-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2004-38-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2004-37-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2004-35-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2112-43-0x0000000000260000-0x000000000027A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2400-41-0x00000000000F0000-0x000000000010A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2716-33-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2716-32-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2716-0-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2716-1-0x00000000000E0000-0x00000000000FA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2716-2-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2772-8-0x0000000002250000-0x0000000002258000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2772-7-0x000000001B480000-0x000000001B762000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2800-31-0x0000000001280000-0x000000000129A000-memory.dmp

    Filesize

    104KB

    Download