Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/11/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe
Resource
win7-20240903-en
General
-
Target
b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe
-
Size
1.3MB
-
MD5
5e8c689ae7f342a2b2dcf76ad9f990d4
-
SHA1
dc659d8c8284c0ec2d5cd4b0c4dd3a250d481331
-
SHA256
b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be
-
SHA512
46bd683b51c45cc92d5b35c236d8e339ab808cd87465eebd7f1a96ccdb28f994e0048a185a46a68dfd106e6fdd6e46a75c85caea180c03ac20ca2e3e778e64c9
-
SSDEEP
12288:0kjmrocDPyNhuTsAGBDNMrRbeyBYidXG4LrXFb2N:0ZbPyNqsAwyFCreDJKN
Malware Config
Extracted
xworm
3.1
savelat19847.duckdns.org:7000
6FO7gyeQQmt4IGRZ
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/memory/2796-10-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2796-8-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2796-13-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2796-15-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2796-17-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 780 powershell.exe 2712 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2644 set thread context of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 powershell.exe 780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2796 regsvcs.exe Token: SeDebugPrivilege 2712 powershell.exe Token: SeDebugPrivilege 780 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2796 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 30 PID 2644 wrote to memory of 2404 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 31 PID 2644 wrote to memory of 2404 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 31 PID 2644 wrote to memory of 2404 2644 b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe 31 PID 2796 wrote to memory of 2712 2796 regsvcs.exe 32 PID 2796 wrote to memory of 2712 2796 regsvcs.exe 32 PID 2796 wrote to memory of 2712 2796 regsvcs.exe 32 PID 2796 wrote to memory of 2712 2796 regsvcs.exe 32 PID 2796 wrote to memory of 780 2796 regsvcs.exe 34 PID 2796 wrote to memory of 780 2796 regsvcs.exe 34 PID 2796 wrote to memory of 780 2796 regsvcs.exe 34 PID 2796 wrote to memory of 780 2796 regsvcs.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe"C:\Users\Admin\AppData\Local\Temp\b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regsvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2644 -s 6562⤵PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5b7c9903c67d6d770adcf13210e1e9b70
SHA1c731455e7844d16c45309a99cd3ee9544badc041
SHA2562aa4ecab89739abaa8cfa44c8c6768a4a0aeb3715eaa2e957fb9ada6dab2e0c8
SHA512d03717e32b0fa91cc8035485f304ae05df16ab96b1af27cbffee0c13c9bd496e7abed640b9b9175e29495e51f388e296f94746323aaf14b95c2e2bfd52ba09f4