Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 03:35
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
bddaabbc19e96b8ff0fdd80d8397b0ce
-
SHA1
fa11ea037f3b8681d1110badfa61d820dc5219e4
-
SHA256
d823b24077b877fef72715f39ee4580f0f3121af087303ea6ec9ecf4a1ff184e
-
SHA512
d8d57e1dc0a431b662fb87bbcc7625ab296b510cabb7586d2c5d3dba971a9a0dcec39e506b041acbc15fada9df553490a91a72bd0443027990f7705288ff9553
-
SSDEEP
1536:/bCcsuGz0xumH4yA6y9pBRQRbNsD7CsCAY26AwuxH5OFiRy7aqxWV3M:/bC6im9AHBRQRbNsyehZOFigLxW1M
Malware Config
Extracted
Family
xworm
C2
completed-rally.gl.at.ply.gg:28996
Attributes
-
Install_directory
%LocalAppData%
-
install_file
Windows Data Compiler.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2528-1-0x0000000000150000-0x000000000016A000-memory.dmp family_xworm -
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2528 Bootstrapper.exe