Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
17112024_0044_twBkX.js
Resource
win7-20241010-en
General
-
Target
17112024_0044_twBkX.js
-
Size
199KB
-
MD5
4ceb1057e744898bc02ffe2a9daa061a
-
SHA1
ccc89e9d665bc204347fbc7346957ed65ef983ba
-
SHA256
d2c8b31ed90c86ec267b673178ce22b36096ff8d705cbf9b5fa8ed4bac87550b
-
SHA512
3a71dba04527b03bb0ee1384f92b33eaa3de7bb3f1521997fd3151ef9ce553bfb5608054919b37c35f0f6f611acf59805949e586e52e3ca2cfc85e57f246c87a
-
SSDEEP
6144:PsnbkwFgwHtYdNCI8UpzdKxJzyU+JnkdTm6YDwDB:jNCzxpDB
Malware Config
Extracted
xworm
5.0
185.162.75.19:7000
AyJZQz7cchpO5oie
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6460930418:AAGMLktYHOrDqJ5cDoT5GtLWliQfxKax0DI/sendMessage?chat_id=6746471576
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3184-17-0x00000000557D0000-0x00000000557E6000-memory.dmp family_xworm behavioral2/memory/3184-20-0x00000000557D0000-0x00000000557E2000-memory.dmp family_xworm -
Xworm family
-
pid Process 1668 powershell.exe 3680 powershell.exe 3540 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\myscript.lnk wscript.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1668 set thread context of 3184 1668 powershell.exe 86 -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regbrowsers.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3184 aspnet_regbrowsers.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1668 powershell.exe 1668 powershell.exe 3680 powershell.exe 3680 powershell.exe 3540 powershell.exe 3540 powershell.exe 3184 aspnet_regbrowsers.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1668 powershell.exe Token: SeDebugPrivilege 3184 aspnet_regbrowsers.exe Token: SeDebugPrivilege 3680 powershell.exe Token: SeDebugPrivilege 3540 powershell.exe Token: SeDebugPrivilege 3184 aspnet_regbrowsers.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3184 aspnet_regbrowsers.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3948 1020 wscript.exe 83 PID 1020 wrote to memory of 3948 1020 wscript.exe 83 PID 3948 wrote to memory of 1668 3948 cmd.exe 85 PID 3948 wrote to memory of 1668 3948 cmd.exe 85 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 1668 wrote to memory of 3184 1668 powershell.exe 86 PID 3184 wrote to memory of 3680 3184 aspnet_regbrowsers.exe 94 PID 3184 wrote to memory of 3680 3184 aspnet_regbrowsers.exe 94 PID 3184 wrote to memory of 3680 3184 aspnet_regbrowsers.exe 94 PID 3184 wrote to memory of 3540 3184 aspnet_regbrowsers.exe 99 PID 3184 wrote to memory of 3540 3184 aspnet_regbrowsers.exe 99 PID 3184 wrote to memory of 3540 3184 aspnet_regbrowsers.exe 99
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\17112024_0044_twBkX.js1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UPDATE.ps1""2⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UPDATE.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'aspnet_regbrowsers.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
1KB
MD5a2b24af1492f112d2e53cb7415fda39f
SHA1dbfcee57242a14b60997bd03379cc60198976d85
SHA256fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA5129919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
-
Filesize
18KB
MD5d5bde926e657169ec7fbad21220dc925
SHA161e46a45f0f4ff7e433285baf6678de9d3c8a328
SHA256d583eb2f50d82e416e57e1c0998f1974eaa4747fcf5644ca852a8c0913b0a6b5
SHA5123b853dc9f8d717ffa6036dcaa3f416b3aaffd34aff36b64673d993ea19c189c2a5ccdb055e9a374353ecec3b5fca57a4dd29a2b85fd42ea959d9026ba0bdc35e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
196KB
MD567ea1d562d1ed27916829a569dbc7fb5
SHA17d083620f91219c67b7e0a2925a3cb8c987d00ee
SHA25661b54b21f003b1133e63b76fe99a0750303e17a7cc93ea4535c5533b028b1781
SHA5125d03188a7e5e3fd5f9702b9ac2255cc8d5f23dc0d101f5ffb84d411d0c89021af704383f8f2ee88af3a696a7576b8a338fa4140d9396ff6a6e299f1b511d39b4