Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-08-11...ar.exe

windows7-x64

10

2024-08-11...ar.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 05:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe

  • Size

    173KB

  • MD5

    26725cf3fb54af101e327b4ffc155118

  • SHA1

    ebd17076cf65ce0563c3e54d18f1f3b77e95f4d6

  • SHA256

    18c0f9cce906b9295fdadbcc606930cfea7d4599d3965469665f112e247e895b

  • SHA512

    e63824fa87ca2caf7cde5a44ab0452f1a5bec4defc7bce76cfa8405d5761f05f7c6868e2355693463d531f78e7dd1f5f64698982c4dd94b359c3dda0a744b6cc

  • SSDEEP

    3072:kezJfnyqEpTdb84MFjzO7KJ7WM+lmsolAIrRuw+mqv9j1MWLQT:kezJfnyqebGtFJx+lDAA

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:5702

212.192.28.149:5702
Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7317716102:AAGpyJa5ajRKheEXeoE7x43noXNRhB5W808/sendMessage?chat_id=7237867845

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2024-08-11_26725cf3fb54af101e327b4ffc155118_hiddentear.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Xclient'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Xclient'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1380
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Xclient" /tr "C:\Users\Admin\AppData\Roaming\Xclient"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3048
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {7B8A828A-E73A-4875-8D79-888EC529919E} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Roaming\Xclient
      C:\Users\Admin\AppData\Roaming\Xclient
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
    • C:\Users\Admin\AppData\Roaming\Xclient
      C:\Users\Admin\AppData\Roaming\Xclient
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2932
    • C:\Users\Admin\AppData\Roaming\Xclient
      C:\Users\Admin\AppData\Roaming\Xclient
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    d350e95576e6808197bd6de25868e6da

    SHA1

    984e356a24300362c15b75cff74d32b1189f72b4

    SHA256

    bfde8b20cd46958fee3ca96753a1382b4d9048588cb86778445522e7ff45623a

    SHA512

    3a6449712e0697052424ead51e0d61f02fe4bd20e5c98726fcb53c56edb8bf8f255dc3d6cc2a5dc3ce97d08b250ee45713fc190a5a619e1633031485ed620e04

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Xclient
    Filesize

    173KB

    MD5

    26725cf3fb54af101e327b4ffc155118

    SHA1

    ebd17076cf65ce0563c3e54d18f1f3b77e95f4d6

    SHA256

    18c0f9cce906b9295fdadbcc606930cfea7d4599d3965469665f112e247e895b

    SHA512

    e63824fa87ca2caf7cde5a44ab0452f1a5bec4defc7bce76cfa8405d5761f05f7c6868e2355693463d531f78e7dd1f5f64698982c4dd94b359c3dda0a744b6cc

    Download Submit

  • memory/1468-34-0x0000000000BB0000-0x0000000000BE2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1584-41-0x00000000003A0000-0x00000000003D2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2200-1-0x00000000012E0000-0x0000000001312000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2200-2-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2200-0-0x000007FEF5E83000-0x000007FEF5E84000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2200-36-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2200-35-0x000007FEF5E83000-0x000007FEF5E84000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2312-8-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2312-9-0x0000000002010000-0x0000000002018000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2312-7-0x0000000002CB0000-0x0000000002D30000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2564-16-0x0000000001E00000-0x0000000001E08000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2564-15-0x000000001B690000-0x000000001B972000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2932-39-0x0000000000D50000-0x0000000000D82000-memory.dmp

    Filesize

    200KB

    Download