Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear
-
Size
173KB
-
Sample
240811-gjcv4axdpn
-
MD5
26725cf3fb54af101e327b4ffc155118
-
SHA1
ebd17076cf65ce0563c3e54d18f1f3b77e95f4d6
-
SHA256
18c0f9cce906b9295fdadbcc606930cfea7d4599d3965469665f112e247e895b
-
SHA512
e63824fa87ca2caf7cde5a44ab0452f1a5bec4defc7bce76cfa8405d5761f05f7c6868e2355693463d531f78e7dd1f5f64698982c4dd94b359c3dda0a744b6cc
-
SSDEEP
3072:kezJfnyqEpTdb84MFjzO7KJ7WM+lmsolAIrRuw+mqv9j1MWLQT:kezJfnyqebGtFJx+lDAA
Behavioral task
behavioral1
Sample
2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:5702
212.192.28.149:5702
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7317716102:AAGpyJa5ajRKheEXeoE7x43noXNRhB5W808/sendMessage?chat_id=7237867845
Targets
-
-
Target
2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear
-
Size
173KB
-
MD5
26725cf3fb54af101e327b4ffc155118
-
SHA1
ebd17076cf65ce0563c3e54d18f1f3b77e95f4d6
-
SHA256
18c0f9cce906b9295fdadbcc606930cfea7d4599d3965469665f112e247e895b
-
SHA512
e63824fa87ca2caf7cde5a44ab0452f1a5bec4defc7bce76cfa8405d5761f05f7c6868e2355693463d531f78e7dd1f5f64698982c4dd94b359c3dda0a744b6cc
-
SSDEEP
3072:kezJfnyqEpTdb84MFjzO7KJ7WM+lmsolAIrRuw+mqv9j1MWLQT:kezJfnyqebGtFJx+lDAA
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1