Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2024, 11:30

General

  • Target

    b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe

  • Size

    1.3MB

  • MD5

    5e8c689ae7f342a2b2dcf76ad9f990d4

  • SHA1

    dc659d8c8284c0ec2d5cd4b0c4dd3a250d481331

  • SHA256

    b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be

  • SHA512

    46bd683b51c45cc92d5b35c236d8e339ab808cd87465eebd7f1a96ccdb28f994e0048a185a46a68dfd106e6fdd6e46a75c85caea180c03ac20ca2e3e778e64c9

  • SSDEEP

    12288:0kjmrocDPyNhuTsAGBDNMrRbeyBYidXG4LrXFb2N:0ZbPyNqsAwyFCreDJKN

Malware Config

Extracted

Family

xworm

Version

3.1

C2

savelat19847.duckdns.org:7000

Mutex

6FO7gyeQQmt4IGRZ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regsvcs.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:780
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2644 -s 656
      2⤵
        PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      b7c9903c67d6d770adcf13210e1e9b70

      SHA1

      c731455e7844d16c45309a99cd3ee9544badc041

      SHA256

      2aa4ecab89739abaa8cfa44c8c6768a4a0aeb3715eaa2e957fb9ada6dab2e0c8

      SHA512

      d03717e32b0fa91cc8035485f304ae05df16ab96b1af27cbffee0c13c9bd496e7abed640b9b9175e29495e51f388e296f94746323aaf14b95c2e2bfd52ba09f4

    • memory/2644-0-0x000007FEF6453000-0x000007FEF6454000-memory.dmp

      Filesize

      4KB

    • memory/2644-1-0x0000000000090000-0x0000000000098000-memory.dmp

      Filesize

      32KB

    • memory/2644-3-0x000007FEF6450000-0x000007FEF6E3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2644-2-0x00000000004D0000-0x0000000000530000-memory.dmp

      Filesize

      384KB

    • memory/2644-27-0x000007FEF6450000-0x000007FEF6E3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2796-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2796-6-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-8-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-13-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-15-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-17-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-18-0x000000007491E000-0x000000007491F000-memory.dmp

      Filesize

      4KB

    • memory/2796-10-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-26-0x0000000074910000-0x0000000074FFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2796-4-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2796-28-0x000000007491E000-0x000000007491F000-memory.dmp

      Filesize

      4KB

    • memory/2796-29-0x0000000074910000-0x0000000074FFE000-memory.dmp

      Filesize

      6.9MB