Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 16:42
Behavioral task
behavioral1
Sample
mygame.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
mygame.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
mygame.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
mygame.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
mygame.exe
Resource
win11-20241007-en
General
-
Target
mygame.exe
-
Size
137KB
-
MD5
1a925fce50787a5028b73dd32e0c7dce
-
SHA1
7205d5c3d7efbc5805eb0b343a1bc83903e7589c
-
SHA256
00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3
-
SHA512
ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8
-
SSDEEP
3072:6fjh7Fv9fjOwiBz65/M6If+3Js+3JFkKeTno:8hJv9AxBt25
Malware Config
Extracted
xworm
5.0
147.185.221.23:48450
2YsFPOHVMLfmF9px
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 4 IoCs
resource yara_rule behavioral2/memory/2672-1-0x0000000000290000-0x00000000002B8000-memory.dmp family_xworm behavioral2/files/0x0009000000012116-34.dat family_xworm behavioral2/memory/1964-36-0x0000000000990000-0x00000000009B8000-memory.dmp family_xworm behavioral2/memory/964-39-0x0000000000BA0000-0x0000000000BC8000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2544 powershell.exe 2940 powershell.exe 2696 powershell.exe 2616 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk mygame.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk mygame.exe -
Executes dropped EXE 2 IoCs
pid Process 1964 Update.exe 964 Update.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" mygame.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2668 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2544 powershell.exe 2940 powershell.exe 2696 powershell.exe 2616 powershell.exe 2672 mygame.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2672 mygame.exe Token: SeDebugPrivilege 2544 powershell.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 2672 mygame.exe Token: SeDebugPrivilege 1964 Update.exe Token: SeDebugPrivilege 964 Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 mygame.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2544 2672 mygame.exe 30 PID 2672 wrote to memory of 2544 2672 mygame.exe 30 PID 2672 wrote to memory of 2544 2672 mygame.exe 30 PID 2672 wrote to memory of 2940 2672 mygame.exe 32 PID 2672 wrote to memory of 2940 2672 mygame.exe 32 PID 2672 wrote to memory of 2940 2672 mygame.exe 32 PID 2672 wrote to memory of 2696 2672 mygame.exe 35 PID 2672 wrote to memory of 2696 2672 mygame.exe 35 PID 2672 wrote to memory of 2696 2672 mygame.exe 35 PID 2672 wrote to memory of 2616 2672 mygame.exe 37 PID 2672 wrote to memory of 2616 2672 mygame.exe 37 PID 2672 wrote to memory of 2616 2672 mygame.exe 37 PID 2672 wrote to memory of 2668 2672 mygame.exe 39 PID 2672 wrote to memory of 2668 2672 mygame.exe 39 PID 2672 wrote to memory of 2668 2672 mygame.exe 39 PID 872 wrote to memory of 1964 872 taskeng.exe 43 PID 872 wrote to memory of 1964 872 taskeng.exe 43 PID 872 wrote to memory of 1964 872 taskeng.exe 43 PID 872 wrote to memory of 964 872 taskeng.exe 44 PID 872 wrote to memory of 964 872 taskeng.exe 44 PID 872 wrote to memory of 964 872 taskeng.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mygame.exe"C:\Users\Admin\AppData\Local\Temp\mygame.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mygame.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mygame.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2668
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {54F70A2B-2A4E-4546-9BDA-0DD730788C0E} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD52bf6559c1515f3db6f163cb1fc67389d
SHA19d3a4054bce944e81a78f07555e1540f9f0c1ee7
SHA2569747f9ddd63729d767d7380f225b932ed0244813cb8fe0fa83d953d7b4523070
SHA5127637c0888320660ae39429b5d2b6a07466bf92795261c00ccf6a06b97f7dea288bcf1b22444d7fc6e590cefc4ac860c58edbd48286d1d87c536a56e9b1397d48
-
Filesize
137KB
MD51a925fce50787a5028b73dd32e0c7dce
SHA17205d5c3d7efbc5805eb0b343a1bc83903e7589c
SHA25600956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3
SHA512ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8