Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xo/xo.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
xo/xo.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
xo/xo.exe
-
Size
508KB
-
MD5
c65f99714c84f41a883b59da24182ace
-
SHA1
8d1b3c4d26593a5aca3056ad1d5ad4d545b6bde6
-
SHA256
bf532cb4ff5b4da3ca22c3beffc3eaab5f4fbe9aafa2f46eacfbda3d3b3f9079
-
SHA512
156124617720c0a32d2c6d6aaaaa05ef90a66e608cfbd11d2ac1388c27bdb81a37c759d2b1faa595864bdc2a5d8222673959f84d2dee0b5b64eae2fecdc90075
-
SSDEEP
12288:nZ0Xro03psLG8e6k0QwL/odhZOMgSX/NqCf2VgA:QrL5x8e6k0QwL/odhZOMgSX/NqCf2Vg
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff xo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags xo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" xo.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} xo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" xo.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff xo.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 904 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe -
Suspicious use of SendNotifyMessage 61 IoCs
pid Process 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe 904 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2692 xo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xo\xo.exe"C:\Users\Admin\AppData\Local\Temp\xo\xo.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2692
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:904
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2620