Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2f38d2f40f80df0ce510c5c5a35c463e26ed1a2886c1a8cffcc406630551476b
-
Size
56KB
-
Sample
240818-fx973sxelh
-
MD5
315566bb8899185bbd85056e7ed898a4
-
SHA1
0096bec2059e253ea971f520e7ac6f755d953e10
-
SHA256
2f38d2f40f80df0ce510c5c5a35c463e26ed1a2886c1a8cffcc406630551476b
-
SHA512
2fc65aab8880c4d83796d5970c63c8fd7ee7b470da4644f500c1482530707ee37e31ce03f881e3664f4717f35709cec64ee44f45ab22ee0b47b108cf2340e8ec
-
SSDEEP
768:pIvxNr47QZI+bBjYxrhExA1a6lHS6f1UFNBGzs/QZ46wkh3qL0RBuR2w/9kd6jhH:p8xp47Qy6bUiTEzUo4doSzmd63E+
Behavioral task
behavioral1
Sample
9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
3.1
179.118.199.252:7771
-
Install_directory
%AppData%
-
install_file
USB.exe
Targets
-
-
Target
9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3.exe
-
Size
89KB
-
MD5
7758ee1f6165c9cec1113f8b1b7c1b72
-
SHA1
5e5fa255f2e0c2eb0c02dd055ba0004292a8cf70
-
SHA256
9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3
-
SHA512
6a70f60b0ee566cb5d26f6fad36c440cca5d9f89fce2d3355b222b499b321b0fa4d4cdab74a4fd98d4286450235d7eaaf8bc0eef6a13d2404121428a657ef612
-
SSDEEP
1536:YKpPAEG0RI/8PXVd4rbIlUSgwlpZr9O0Eik23C7Hx:jIEGH0PFdKbIlqwlp59O0EiN3C
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1