Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XClient.exe
-
Size
58KB
-
Sample
241117-fdam4s1hjf
-
MD5
0b664dbbbb3530b7f6bef9b1d61addb9
-
SHA1
9f5d5bd42ec1c44db3274396754db0c46ac169a5
-
SHA256
48d74602d8e488f13359a7c54e4ff30e3e48d44190e57153539207b57a0f3ea4
-
SHA512
6adff37cac5cc056f17c63b7cfefe6d7d4ab1da19ca3c5b59cbf22ead471e3c7416ff2b70eaf8be81af77dffabbd521aa563296eef6297e1e71bcbb42f9293cf
-
SSDEEP
1536:NELc8UB3jYNK6stQKEHSWcagrR4Zb/sordrmt69O0b0BQ5O:mLvUtYVTKEHSWcNR4Zb/JdO0b0BIO
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Extracted
xworm
3.1
147.185.221.22:4999
-
Install_directory
%Public%
-
install_file
USB.exe
Targets
-
-
Target
XClient.exe
-
Size
58KB
-
MD5
0b664dbbbb3530b7f6bef9b1d61addb9
-
SHA1
9f5d5bd42ec1c44db3274396754db0c46ac169a5
-
SHA256
48d74602d8e488f13359a7c54e4ff30e3e48d44190e57153539207b57a0f3ea4
-
SHA512
6adff37cac5cc056f17c63b7cfefe6d7d4ab1da19ca3c5b59cbf22ead471e3c7416ff2b70eaf8be81af77dffabbd521aa563296eef6297e1e71bcbb42f9293cf
-
SSDEEP
1536:NELc8UB3jYNK6stQKEHSWcagrR4Zb/sordrmt69O0b0BQ5O:mLvUtYVTKEHSWcNR4Zb/JdO0b0BIO
Score10/10-
Detect Xworm Payload
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1