Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.DownLoader47.48553.17653.26482.exe
Resource
win7-20241010-en
General
-
Target
SecuriteInfo.com.Trojan.DownLoader47.48553.17653.26482.exe
-
Size
158KB
-
MD5
f39aa63640544e201c35e4ecc70f5b6c
-
SHA1
6f7cbcf265f9a8160df7e9f5344a377e26da93c1
-
SHA256
d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc
-
SHA512
2ea8ac295d56cb017719eeca9eabc34fd23f724749d83883584d3a639b50ae2245e3eb89467d1621716c3ed54afcd822311c892fa15278b125329d93612ab08a
-
SSDEEP
3072:VyQjswuedxx2GFQ5psohfNUshn76Wtve7gRPyXVxj+5OWO8GwmQqoyK+EtY:VyQYOdyIQ5pvhfDn7HvcHC9Gw/ixE
Malware Config
Extracted
xworm
xxxx.freedynamicdns.net:1997
-
Install_directory
%LocalAppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot7470132733:AAFv29agMHCbkbiHbNHt7LzTib-Els5808o/sendMessage?chat_id=761641337
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1268-3-0x00000000004D0000-0x00000000004EA000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.Trojan.DownLoader47.48553.17653.26482.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1268 SecuriteInfo.com.Trojan.DownLoader47.48553.17653.26482.exe