Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

FALLO ACCI...ES.bat

windows7-x64

10

FALLO ACCI...ES.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FALLO ACCIÓN DE TUTELA 2023-250 JDO 02 CMES.zip

  • Size

    6KB

  • Sample

    241114-tz3snsvlfj

  • MD5

    298e4d9405ddb8493d6b7beff47b1f40

  • SHA1

    337ffe4c1032276b6ac4997cdb8e549ad3bed5c3

  • SHA256

    0cf292ac0cdac7a8a901ca29ad6db6782fc49ad1b29508c22c1c77c9c823434b

  • SHA512

    d91f2c3dcd115dd6e25aff3d25243571b45a1d80eaf80169c86fba8a54b3c80b00741100711c103d21ab119cce9f115384759183c0a4eb289706d6a5f1a28644

  • SSDEEP

    192:cerAWJ85Qm+CgkpP01O598cF72VzEb6BY:cgxwR+OqU38cwVo6u

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f
exe.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f

Targets

    • Target

      FALLO ACCIÓN DE TUTELA 2023-250 JDO 02 CMES.bat

    • Size

      210KB

    • MD5

      24e3c5a8c5ce37efb76a08a124a2f525

    • SHA1

      1378fa68873d9ce2368aac281632ff5dab2f59d0

    • SHA256

      233bca3f0a5f3dbc98d3765ecc8631fd552366a78f052cc13c970b94a107e459

    • SHA512

      e9ae4a7948cefe01143e5646220f9b6d1c78b34db0ec4f2220d74daf8add209d5b55f76eb2fcf2b3d995cdeee957aebb3e0f9f736cced0ddba8ba249d18bcc62

    • SSDEEP

      6144:vZuSzJTZolPPaVOZwrXQJ5RV5RFVVjRbVbJlv8:B

    Score
    10/10
    executionxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks