Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 20:09

General

  • Target

    XClient.exe

  • Size

    34KB

  • MD5

    17e7008acdf564a64c66b5e1551de7d1

  • SHA1

    89b9db120317d212ade05c2c300fe461d324d1a0

  • SHA256

    1a875a261fd81412ed0bc0dd53084dd6e9b7a5545802a1c37d85efeb3ec314bd

  • SHA512

    f4eb1e7c9997e3e9714e455b097081e52e3af72e5017c5ee2ab34c0cefcf197183f75f7a31870319ac24f36696778885f01d94accd3b5b866dbc20a406c36735

  • SSDEEP

    768:pXuuB5cBenG5Z96pbWx9FV9jJOjhj/4e:pXu25cBeGjspW/FV9jJOjZQe

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

lefferek-42016.portmap.host:42016

Mutex

CvqERIOnQqEv3r1K

Attributes
  • Install_directory

    %AppData%

  • install_file

    DiscordClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2392-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

    Filesize

    4KB

  • memory/2392-1-0x0000000000F60000-0x0000000000F6E000-memory.dmp

    Filesize

    56KB

  • memory/2392-6-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2392-7-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

    Filesize

    4KB

  • memory/2392-8-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

    Filesize

    9.9MB