Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17/11/2024, 04:50

General

  • Target

    Api-AutoUpdaterV2.exe

  • Size

    87KB

  • MD5

    9f9e3e562c3ace91fd36c7d9b49c56a7

  • SHA1

    32317350629c0591b49726ad71ab49e12b208918

  • SHA256

    c2306587c0e582a16037717598479523ba07d1afb646ab4a4ab63173adaaa971

  • SHA512

    8a60f2a143475fed2837a670717c5e35bcb0c0602fd633cda4efdfdd95ae15c407077fca5b7e5ac1dd771acc994f7f3b3fdff589dc3f613bce6144cdc3c7df8d

  • SSDEEP

    1536:CLVnqRcrCwNlhr/CbCRSCpv1ZLFNxdlub5mUnaC9UWGIiEdrRFbw0I5oKV+Uq4Q3:CslcCbCRBnFNblub5mUavWGAfFbwVVTQ

Malware Config

Extracted

Family

xworm

C2

job-moore.gl.at.ply.gg:49404

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Helper.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdaterV2.exe
    "C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdaterV2.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Api-AutoUpdaterV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdaterV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Api-AutoUpdaterV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3316
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "Api-AutoUpdaterV2" /tr "C:\ProgramData\Api-AutoUpdaterV2.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Api-AutoUpdaterV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Api-AutoUpdaterV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsDefender'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:2084
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsDefender" /tr "C:\ProgramData\WindowsDefender"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2080
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2088
  • C:\ProgramData\Api-AutoUpdaterV2.exe
    "C:\ProgramData\Api-AutoUpdaterV2.exe"
    1⤵
    • Executes dropped EXE
    PID:4904
  • C:\ProgramData\WindowsDefender
    "C:\ProgramData\WindowsDefender"
    1⤵
    • Executes dropped EXE
    PID:528
  • C:\ProgramData\Api-AutoUpdaterV2.exe
    "C:\ProgramData\Api-AutoUpdaterV2.exe"
    1⤵
    • Executes dropped EXE
    PID:3740
  • C:\ProgramData\WindowsDefender
    "C:\ProgramData\WindowsDefender"
    1⤵
    • Executes dropped EXE
    PID:3660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\WindowsDefender

    Filesize

    87KB

    MD5

    9f9e3e562c3ace91fd36c7d9b49c56a7

    SHA1

    32317350629c0591b49726ad71ab49e12b208918

    SHA256

    c2306587c0e582a16037717598479523ba07d1afb646ab4a4ab63173adaaa971

    SHA512

    8a60f2a143475fed2837a670717c5e35bcb0c0602fd633cda4efdfdd95ae15c407077fca5b7e5ac1dd771acc994f7f3b3fdff589dc3f613bce6144cdc3c7df8d

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Api-AutoUpdaterV2.exe.log

    Filesize

    1KB

    MD5

    2b4889ecb49120375fdf2bccb3c0966e

    SHA1

    fc1ee2f1161887e3f8b0cdd2453ae441739b993a

    SHA256

    7bf24ff0f6791ef902937b3caba0de16814a2c898dfb103d922c48582b602379

    SHA512

    8d737276620add4738d3cb484bca8e1efe23247955d37ebad199d2428f2f494e10dbee98721a77c7fa9d55f662c230acb206894538da9b8a9d0314166b5549a3

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    3eb3833f769dd890afc295b977eab4b4

    SHA1

    e857649b037939602c72ad003e5d3698695f436f

    SHA256

    c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

    SHA512

    c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    af1cc13f412ef37a00e668df293b1584

    SHA1

    8973b3e622f187fcf484a0eb9fa692bf3e2103cb

    SHA256

    449c0c61734cf23f28ad05a7e528f55dd8a7c6ae7a723253707e5f73de187037

    SHA512

    75d954ec8b98f804d068635875fac06e9594874f0f5d6e2ad9d6267285d1d4a1de6309009de9e2956c6477a888db648396f77a1a49b58287d2683b8214e7a3d3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    87e99003b41b406b16a979a7f29afede

    SHA1

    8ca487ae1547b02228d3d3754e4d7fe00a7cc16a

    SHA256

    40ee14627b2772924b2c691eb6a505216a04b27719cc55509edf41364117ec1a

    SHA512

    eb68867d3829493b82da3cccbb9113c612d1ce2ba7a909f2ae64d52dd24e9de9438747a44c96889ad531006abaec7dd29071c4d860b610092434654ab89a2e24

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    b5c2aac7bf3d80e3db38a59ca85917ed

    SHA1

    b27e6459afa6f5352a3ef0c6ce26c26ca7d81730

    SHA256

    9ad352246e684349395a1897a3d9a51859558261af6fd1d674aa2b44cd1a3e5b

    SHA512

    0de17353fb7ecb4681824227b4519465e7da464e611bd60c3bfb000eacce43737f3234fcc7919a188f871eed67be99d983c91579c0199d129e99a35e33b265d5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    014f71a6acded9d2985322a79aa49202

    SHA1

    622c887c223d4807b6fff00bcec733f29d3070c4

    SHA256

    2706f51a2e6b15845205415791c33cc03c21aaa7421c46f5651df06d81f76d19

    SHA512

    199dadd2b954b9f27e7290bf1f383c476ad2d93883243aa86d23408d016006ac4d39993bd3aa4b6d93a828aecafd66dd8ef431dca5d3c98b5fd86b4c96cb3a56

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    d99c6243194b8ff23aa4092dd85f7646

    SHA1

    3c0111acadfcc29f0f44d34480922716cc1b435d

    SHA256

    b883b8c5ed41d97df2ca5e5619374496f67dc1ff82beca9e73ac3dafd1b60961

    SHA512

    53bb6652e467c3fce0e891d85d7e064c4e7748bb143ffac4490e08cdefa8b5b9ba79b24fe04284d5e6f9875a5a6280f06cf3815f2ceea4df5144b6abb222ce4f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    5961a815c0bfd0a47ea76f6b96a9d016

    SHA1

    8b626a08f2b71ca64abf42790e976406193efc9a

    SHA256

    f1bfbb67b28e7d8d92b347e484524cf624593f283d3aaeffbac2c6e794c29e6f

    SHA512

    524280fff2a5ad9ec2a37282700da11e61011044dccd855e5da8c642eee7161ad922316a06da7ef0db02f7b0746aa7280a9b4dc3111b6468c90a35df4851fa73

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phsb5v0i.fd3.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk

    Filesize

    688B

    MD5

    22931150d7c86ff5efe7d66bc81473dc

    SHA1

    e3437459e6c097f424fc3984d0e7c6c7ae27f25a

    SHA256

    4b38908b5d5d7fa4fb7c4c9cdd2d3b514a1d594df08222f05258d2a6448638e0

    SHA512

    7248875f4e1b61de77a803662282145274016d86fe97754e1caf252129a95d4ad49fb60126a4cacf05ff9e246ee4242101a733aac81a2275809141307ce9214b

  • memory/1156-2-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/1156-0-0x00007FFC03DE3000-0x00007FFC03DE5000-memory.dmp

    Filesize

    8KB

  • memory/1156-21-0x00007FFC03DE3000-0x00007FFC03DE5000-memory.dmp

    Filesize

    8KB

  • memory/1156-33-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/1156-1-0x0000000000B80000-0x0000000000B9C000-memory.dmp

    Filesize

    112KB

  • memory/1156-47-0x0000000002D30000-0x0000000002D46000-memory.dmp

    Filesize

    88KB

  • memory/2088-107-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-105-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-101-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-102-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-96-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-95-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-97-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-103-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-106-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/2088-104-0x0000029FA1690000-0x0000029FA1691000-memory.dmp

    Filesize

    4KB

  • memory/3008-20-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/3008-15-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/3008-16-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/3008-17-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/3008-14-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB

  • memory/3008-13-0x00000296FF560000-0x00000296FF582000-memory.dmp

    Filesize

    136KB

  • memory/3008-3-0x00007FFC03DE0000-0x00007FFC048A2000-memory.dmp

    Filesize

    10.8MB