Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 01:52
Behavioral task
behavioral1
Sample
1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe
Resource
win10v2004-20241007-en
General
-
Target
1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe
-
Size
188KB
-
MD5
e796b778b392f06de4d340ec0f88b4cc
-
SHA1
32561bf3b022aef8a62bac3e820ef7e3bc648f57
-
SHA256
1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05
-
SHA512
dcdbeb8d1720b2bfe8ce8c2311414b71ec090eb94db53d379c08cbf7b17a25ac4bc9488315e867406bb1661a76df223c953f01c7d40997fdf9ccb20daaf4c8c7
-
SSDEEP
3072:2rhv4AbmL4mkbrz9EO7PvJKRUGKXs+S++7KFSbxeY+qDDrMn:2r7bmclbX3ZGqStKEbxI
Malware Config
Extracted
xworm
23.ip.gl.ply.gg:57660
-
Install_directory
%AppData%
-
install_file
msedge.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2656-1-0x0000000000220000-0x0000000000254000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2600 powershell.exe 2720 powershell.exe 2624 powershell.exe 2628 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedge = "C:\\Users\\Admin\\AppData\\Roaming\\msedge.exe" 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2600 powershell.exe 2720 powershell.exe 2624 powershell.exe 2628 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2600 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 28 PID 2656 wrote to memory of 2600 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 28 PID 2656 wrote to memory of 2600 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 28 PID 2656 wrote to memory of 2720 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 30 PID 2656 wrote to memory of 2720 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 30 PID 2656 wrote to memory of 2720 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 30 PID 2656 wrote to memory of 2624 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 32 PID 2656 wrote to memory of 2624 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 32 PID 2656 wrote to memory of 2624 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 32 PID 2656 wrote to memory of 2628 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 34 PID 2656 wrote to memory of 2628 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 34 PID 2656 wrote to memory of 2628 2656 1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe"C:\Users\Admin\AppData\Local\Temp\1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1ff08d4cbe1a41c10692941c7835b93ea5738057dc381cf4704136436911df05.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5a9201e1ffa3698ded9100f92e428c8fb
SHA14353ddc3ef720ea6ded1025656d32fb8bf2cd36d
SHA256df597c2e8762518710a284ba009067daaa101ef93a63eccd1cc88154cbd5c01d
SHA51247ff76c49b3b23ab58eb1544b04145007ede9d98a37c367b240dd1f11b54692424a5a66b0c1893150b751f5d892eba828dd764317034def425eec0bc6aede1a7