Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe
Resource
win7-20240903-en
General
-
Target
d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe
-
Size
292KB
-
MD5
a25ea5ab2a959e8fbefe0724f1bb5b5b
-
SHA1
49208ffd7c4a5a6df5336f1269f2fa7aeef5fe18
-
SHA256
d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10
-
SHA512
4870b56c286516bf97e4ca8cd232a5978f423c2d3a971218866ad8ce50e68fd382b7d97f5fe8fb443a99d5d99971f75a09524526536e292d258831abd12d88b4
-
SSDEEP
3072:MpkJuuEpKi6m/PJivSaAFOg7lkjcWVig058YbEASbod9btH:
Malware Config
Extracted
xworm
23.ip.gl.ply.gg:7000
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000700000001211a-8.dat family_xworm behavioral1/memory/2568-10-0x0000000000B40000-0x0000000000B58000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 2568 .keepme -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 .keepme -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2792 2872 d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe 30 PID 2872 wrote to memory of 2792 2872 d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe 30 PID 2872 wrote to memory of 2792 2872 d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe 30 PID 2792 wrote to memory of 2568 2792 cmd.exe 31 PID 2792 wrote to memory of 2568 2792 cmd.exe 31 PID 2792 wrote to memory of 2568 2792 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe"C:\Users\Admin\AppData\Local\Temp\d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\cmd.exe"cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\.shhh.bat" && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\.keepme"C:\Users\Admin\AppData\Local\Temp\.keepme"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD55dcabac99e75c26966103e37d2d34fff
SHA1ee5ff56baaa7c854034a1952df3aebcb9051e2d9
SHA256889f0dbaf5641f17b2fff411473f75c62b551d11bedf4bb16b191f78f38a99e2
SHA512ec38e9bee65d3ad6ff31c1381a7e7b646544c44c3c944f387e02b7d1825cadf4fe0dfd7d914fa7872f8ba8b2862c0861eae91fce129ef30299afda639681f127
-
Filesize
57B
MD5cbade861cdb94418af59f05e2c2ba9d2
SHA1b52c1e9152f513e1c5bfd0a7120d8eab5715c6fa
SHA256690a862f8ba36d42573f9080aecd43eb6744b842cb382cee2bafdc493dae1ed4
SHA512fbdea30ef08dfde692d7d55e6b847a49448f095ac0dc7f4cb2aa87d1a965f681397db9ff5f25beb9ad48bf61578ccefdf7191de12ea9e8faba376bca0fd89d70