Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
Windows Shell Experience Host.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
Windows Shell Experience Host.exe
-
Size
86KB
-
MD5
17f122079462e212871a1e2eb20eaff9
-
SHA1
349e4b54323acce835916a2bbe40dc9c5d30931f
-
SHA256
f483197df60b8767d23fa820efaab0c6bcc3a4b02ebee3c8f1290ef699f6697e
-
SHA512
95548cb30e9e45c4024be181253200d2188b622754158f6268fa09e41327dbb8468399a1b5ddd9d868413638bf1b9b18f6814586530f2c6a0a6cbd6311234e94
-
SSDEEP
768:NG9nICDiZGhCMhOB0s1SbiFG9Ox7h86BOMhUL02dC+IHZK:NgICDiZQRhVeFG9e7h86BOM+Nd6c
Malware Config
Extracted
xworm
5.0
147.185.221.20:65300
RMe1pa1UgjNcB2Un
-
Install_directory
%AppData%
-
install_file
Windows Shell Experience Host.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Windows Shell Experience Host.exe
Files
-
Windows Shell Experience Host.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ