Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

8f9e0d533f...6e.exe

windows7-x64

10

8f9e0d533f...6e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2024, 19:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e.exe

  • Size

    275KB

  • MD5

    bac631aa713e238ca4cc65b620736715

  • SHA1

    d0f7bcda4d2fdcf3e1f41859e5251d021603f909

  • SHA256

    8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e

  • SHA512

    731cc3e56c4b48b278c512712068c815fcd989ed5250c2443c3e38d36eac8e40d969d9b84dfbd1e28fe80c555255006440ec24aa904c63e2d31a086a8bfb11d3

  • SSDEEP

    3072:RdOB4dT+b7chk6qvFORJgmXbcK0L4AFD/l8xZ4uIxPLKKx03fJqWkG1SpPlpQJQU:RdOCob7oOEbGCIEfWcSlaUM/g

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

23.ip.gl.ply.gg:57577

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e.exe
    "C:\Users\Admin\AppData\Local\Temp\8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8f9e0d533fa5774f0653db9f900b4ef4356d8b3f1f8a90ae5f57bab24f14d86e.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2UF23BZ6T4EDYVCFXVQ4.temp
    Filesize

    7KB

    MD5

    467450f825c18778507b83407f63f937

    SHA1

    1e62e3efa549ead08917e4ff5e1b2184dc6986b2

    SHA256

    716dd46151f67637ce9079b6e01ed8e24921bd5a302f0c51aab06d5685b74bc3

    SHA512

    99df4ec213750f930cfdd0b41c8351c21a501f4f7792537d839574eabd347e4ba27c6666eea5133ac7ebdc343d83e6482da83f7dc4e9978ef352f3940e114892

    Download Submit

  • memory/2664-15-0x00000000027E0000-0x00000000027E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2664-14-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2680-6-0x0000000002A50000-0x0000000002AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2680-7-0x000000001B660000-0x000000001B942000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2680-8-0x00000000028F0000-0x00000000028F8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2816-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2816-1-0x0000000000300000-0x000000000034A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2816-31-0x000000001B250000-0x000000001B2D0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2816-32-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2816-33-0x000000001B250000-0x000000001B2D0000-memory.dmp

    Filesize

    512KB

    Download