Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

PROCESO JU...AL.bat

windows7-x64

10

PROCESO JU...AL.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5fdd483e37c151f64ab1b9a0cee44cf7.zip

  • Size

    6KB

  • Sample

    241108-ct5awaslg1

  • MD5

    5fdd483e37c151f64ab1b9a0cee44cf7

  • SHA1

    6ab7cbce20473d495b196faa7a89d36c31f0f9ce

  • SHA256

    1b35e2c987783e9620435b2632c9171d5e186b37669597973dab9836db641897

  • SHA512

    cc4b3a9389ece79dbcf692813527a712043b83f17e43be4dca8f9836c9c34ae776b399c06451bc22bcc5e61496a92930fdf4ca0be6df7609e0029a4686e3c7fe

  • SSDEEP

    192:Iw/xc57zXMZymAb9x/5kCJEPX6bHtnuydL6We:IGOcymAhzwPqbNnuyR6We

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f
exe.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f

Targets

    • Target

      PROCESO JUDICIAL N0° 003494 9494 - ACUSACIÓN JUDICIAL.bat

    • Size

      210KB

    • MD5

      24e3c5a8c5ce37efb76a08a124a2f525

    • SHA1

      1378fa68873d9ce2368aac281632ff5dab2f59d0

    • SHA256

      233bca3f0a5f3dbc98d3765ecc8631fd552366a78f052cc13c970b94a107e459

    • SHA512

      e9ae4a7948cefe01143e5646220f9b6d1c78b34db0ec4f2220d74daf8add209d5b55f76eb2fcf2b3d995cdeee957aebb3e0f9f736cced0ddba8ba249d18bcc62

    • SSDEEP

      6144:vZuSzJTZolPPaVOZwrXQJ5RV5RFVVjRbVbJlv8:B

    Score
    10/10
    executionxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks