Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/09/2024, 06:31
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
test.exe
Resource
win10v2004-20240802-en
General
-
Target
test.exe
-
Size
32KB
-
MD5
9ef813f8d17e2b07e3e22ca9136cfde3
-
SHA1
5b75837d1ec6b17af46ea657431424e876977b0b
-
SHA256
893847d848f3a7dad901866ad350530f91100d52c3db60fbefec8a9f33f1d472
-
SHA512
8862cd1cb967ccb66106f031ef37fc6dbc4a240101aa3782b66b5f5a0810e78dfc47eab8c5ce0c26e7acc637ecdf391b4f0ea6d4ec99411e4e5bf270aad083b6
-
SSDEEP
768:mRPD9OQhx/Bg3Tw4xKdVFE9jAVLFOjh1b2:md9OW/g3U4xcFE9jAVLFOjXK
Malware Config
Extracted
xworm
5.0
4.tcp.eu.ngrok.io:19050
FT7jVsIDwcsDC2pB
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4616-1-0x0000000000C10000-0x0000000000C1E000-memory.dmp family_xworm -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 1 4.tcp.eu.ngrok.io -
Delays execution with timeout.exe 1 IoCs
pid Process 620 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4616 test.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2316 4616 test.exe 75 PID 4616 wrote to memory of 2316 4616 test.exe 75 PID 2316 wrote to memory of 620 2316 cmd.exe 77 PID 2316 wrote to memory of 620 2316 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2CA9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD5b0f852b11da977847f1d62490fccccf8
SHA181b5527bc11c432e223059ad650dcf8c1c47093b
SHA256a19e6b0333fc6054af5765bc3892401e6a4d9907a1da4ad2cf707b569b43fcf1
SHA51276d98513e76cf361d9d0f7409d288b4935bb148d9bee3288466b2b74a7e8498660dfc9d24e6b77315bc6854ea02d10e61ed6e901d7a48a246a57f62028acb847