Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/11/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe
Resource
win7-20240903-en
General
-
Target
44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe
-
Size
1.8MB
-
MD5
1a76cd545f61ab6f965ae5993b17ce2f
-
SHA1
900c219ab0607cec8bbf66db64c66e73272060e4
-
SHA256
44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90
-
SHA512
78515c77b7d93f23203269771a2f75a47910070c3173516e541c6c566f8e016eb96d53cbf4850b5ba5d33c81d59f99f47400e2fffe0c479ef5e77532731993c9
-
SSDEEP
49152:MPmiqmEQ+gM0zmOEULu1rnhgR8tub1xBEXFe3IsS:6X+7sm9Dg2dXFMJ
Malware Config
Extracted
xworm
87.120.112.33:8398
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/3064-1-0x0000000001320000-0x00000000017A6000-memory.dmp family_xworm behavioral1/memory/3064-2-0x0000000001320000-0x00000000017A6000-memory.dmp family_xworm -
Xworm family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2136 powershell.exe 2876 powershell.exe 2588 powershell.exe 2792 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 2876 powershell.exe 2588 powershell.exe 2792 powershell.exe 2136 powershell.exe 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2876 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 30 PID 3064 wrote to memory of 2876 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 30 PID 3064 wrote to memory of 2876 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 30 PID 3064 wrote to memory of 2876 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 30 PID 3064 wrote to memory of 2588 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 32 PID 3064 wrote to memory of 2588 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 32 PID 3064 wrote to memory of 2588 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 32 PID 3064 wrote to memory of 2588 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 32 PID 3064 wrote to memory of 2792 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 34 PID 3064 wrote to memory of 2792 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 34 PID 3064 wrote to memory of 2792 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 34 PID 3064 wrote to memory of 2792 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 34 PID 3064 wrote to memory of 2136 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 36 PID 3064 wrote to memory of 2136 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 36 PID 3064 wrote to memory of 2136 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 36 PID 3064 wrote to memory of 2136 3064 44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe"C:\Users\Admin\AppData\Local\Temp\44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '44f611726336cec3fa65ba287bf135af2cd43c6441ead65ce4a54c154ea80f90.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5c386b5cf7661920e8da4f13a8d7d0b1b
SHA1d397a89535340b60fabc16572e9082376a3697da
SHA25682c3131158d3aa2997a56206b880c524174a47ee25170420d320c2d930308d31
SHA512e88a01b026fa837d6ef7d843f45ef1e52c870b6226b9f9460538fcff2aa2702e7a81693aa636c903ba04c530bd316c7f43618a04d41ae9f22e767d60f04471bf