Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 16:42

General

  • Target

    mygame.exe

  • Size

    137KB

  • MD5

    1a925fce50787a5028b73dd32e0c7dce

  • SHA1

    7205d5c3d7efbc5805eb0b343a1bc83903e7589c

  • SHA256

    00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3

  • SHA512

    ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8

  • SSDEEP

    3072:6fjh7Fv9fjOwiBz65/M6If+3Js+3JFkKeTno:8hJv9AxBt25

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.185.221.23:48450

Mutex

2YsFPOHVMLfmF9px

Attributes
  • Install_directory

    %AppData%

  • install_file

    Update.exe

aes.plain

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\mygame.exe
    "C:\Users\Admin\AppData\Local\Temp\mygame.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mygame.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mygame.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2616
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2668
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {54F70A2B-2A4E-4546-9BDA-0DD730788C0E} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Users\Admin\AppData\Roaming\Update.exe
      C:\Users\Admin\AppData\Roaming\Update.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Users\Admin\AppData\Roaming\Update.exe
      C:\Users\Admin\AppData\Roaming\Update.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    2bf6559c1515f3db6f163cb1fc67389d

    SHA1

    9d3a4054bce944e81a78f07555e1540f9f0c1ee7

    SHA256

    9747f9ddd63729d767d7380f225b932ed0244813cb8fe0fa83d953d7b4523070

    SHA512

    7637c0888320660ae39429b5d2b6a07466bf92795261c00ccf6a06b97f7dea288bcf1b22444d7fc6e590cefc4ac860c58edbd48286d1d87c536a56e9b1397d48

  • C:\Users\Admin\AppData\Roaming\Update.exe

    Filesize

    137KB

    MD5

    1a925fce50787a5028b73dd32e0c7dce

    SHA1

    7205d5c3d7efbc5805eb0b343a1bc83903e7589c

    SHA256

    00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3

    SHA512

    ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8

  • memory/964-39-0x0000000000BA0000-0x0000000000BC8000-memory.dmp

    Filesize

    160KB

  • memory/1964-36-0x0000000000990000-0x00000000009B8000-memory.dmp

    Filesize

    160KB

  • memory/2544-6-0x0000000002EA0000-0x0000000002F20000-memory.dmp

    Filesize

    512KB

  • memory/2544-7-0x000000001B710000-0x000000001B9F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2544-8-0x00000000021D0000-0x00000000021D8000-memory.dmp

    Filesize

    32KB

  • memory/2672-31-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

    Filesize

    4KB

  • memory/2672-30-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

  • memory/2672-0-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

    Filesize

    4KB

  • memory/2672-32-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

  • memory/2672-1-0x0000000000290000-0x00000000002B8000-memory.dmp

    Filesize

    160KB

  • memory/2940-15-0x0000000002310000-0x0000000002318000-memory.dmp

    Filesize

    32KB

  • memory/2940-14-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

    Filesize

    2.9MB