Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 01:31
General
-
Target
Stub.exe
-
Size
84KB
-
MD5
2234544e14c7e54e6f4d186b2fd76895
-
SHA1
1d093861228c810fd8027ae27a92c7b2e79c606f
-
SHA256
12d242765341882daf533c354c738074ed726e8e4af92f040d14b5d2ba992d94
-
SHA512
b7af460b642288f40c0e1491e364959006018da2c2f42e98524da43ec208575a58d0d571a97861f5b1e2c8af844b6a5cc07b802d95abd4163e5d0d0768d813ea
-
SSDEEP
1536:hUCfdRQM2DT3m/tTfpTGbqESA7fX6q6Rsxnuc8OyUbf2bd:hJPAm3CbqqX6NsN0OyU72d
Score
10/10
Malware Config
Extracted
Family
xworm
C2
193.161.193.99:25993
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
10.8MB