Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/11/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Item Specifications.exe
Resource
win7-20240903-en
General
-
Target
Item Specifications.exe
-
Size
1.3MB
-
MD5
5e8c689ae7f342a2b2dcf76ad9f990d4
-
SHA1
dc659d8c8284c0ec2d5cd4b0c4dd3a250d481331
-
SHA256
b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be
-
SHA512
46bd683b51c45cc92d5b35c236d8e339ab808cd87465eebd7f1a96ccdb28f994e0048a185a46a68dfd106e6fdd6e46a75c85caea180c03ac20ca2e3e778e64c9
-
SSDEEP
12288:0kjmrocDPyNhuTsAGBDNMrRbeyBYidXG4LrXFb2N:0ZbPyNqsAwyFCreDJKN
Malware Config
Extracted
xworm
3.1
savelat19847.duckdns.org:7000
6FO7gyeQQmt4IGRZ
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2520-6-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2520-9-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2520-13-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2520-11-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2864 powershell.exe 2840 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3056 set thread context of 2520 3056 Item Specifications.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CasPol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2864 powershell.exe 2840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2520 CasPol.exe Token: SeDebugPrivilege 2864 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2520 3056 Item Specifications.exe 30 PID 3056 wrote to memory of 2984 3056 Item Specifications.exe 31 PID 3056 wrote to memory of 2984 3056 Item Specifications.exe 31 PID 3056 wrote to memory of 2984 3056 Item Specifications.exe 31 PID 2520 wrote to memory of 2864 2520 CasPol.exe 32 PID 2520 wrote to memory of 2864 2520 CasPol.exe 32 PID 2520 wrote to memory of 2864 2520 CasPol.exe 32 PID 2520 wrote to memory of 2864 2520 CasPol.exe 32 PID 2520 wrote to memory of 2840 2520 CasPol.exe 34 PID 2520 wrote to memory of 2840 2520 CasPol.exe 34 PID 2520 wrote to memory of 2840 2520 CasPol.exe 34 PID 2520 wrote to memory of 2840 2520 CasPol.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Item Specifications.exe"C:\Users\Admin\AppData\Local\Temp\Item Specifications.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CasPol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3056 -s 6602⤵PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5d5b535379772bb6090fd1d23faa81389
SHA1ac1f6e66df79ee3b9729a1173ac99b21fed50457
SHA2566b6de23e4e944f15bfeb2b7a721c1bc30f28e01731787562a66dcf682978c38a
SHA512208ce5107e6f8585706bc447b39563ba9fe88aba24a9d1a65781c5c5e7c5b84a22e033b822237c69a7d021050c33bad92a636e49d880c9492de332cc00ed5df9