Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 21:05
General
-
Target
b387fc76f390a2760a5242693419f051f17a3071fd9c75ca5b9968c5253edfcf.exe
-
Size
70KB
-
MD5
20ec0ec5f396bf72a91e5943fe426224
-
SHA1
f54cc47328f60dea7788687656992eca18336ae0
-
SHA256
b387fc76f390a2760a5242693419f051f17a3071fd9c75ca5b9968c5253edfcf
-
SHA512
b59f4dba7dbdf49eb90dea48e032ed46f81c752dd142d4fe17710296cb7d16568f4e63b814e3463f21ef213fe7602ff47e40287db06b4b1c2328bcdbdc4805a1
-
SSDEEP
1536:aZtJw+HbdXr7dJBTdVMbr/PNDyQA2w65XOxfks:aZLXRrBEbTI92LXOxfks
Score
10/10
Malware Config
Extracted
Family
xworm
C2
wednesday-knight.gl.at.ply.gg:48312
0xF488F3FA5541d79f0b1945ccA834cD6d939dD864:1
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b387fc76f390a2760a5242693419f051f17a3071fd9c75ca5b9968c5253edfcf.exe"C:\Users\Admin\AppData\Local\Temp\b387fc76f390a2760a5242693419f051f17a3071fd9c75ca5b9968c5253edfcf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB