Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/11/2024, 02:17
Behavioral task
behavioral1
Sample
53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe
Resource
win10v2004-20241007-en
General
-
Target
53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe
-
Size
255KB
-
MD5
e03c1771945c884883a82704a93ca453
-
SHA1
78609d9940ec6e59db7961ec2ac859c68ce81186
-
SHA256
53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df
-
SHA512
ed063720d08c2cd8b674101b5d457795ec570fee19c1e0747fd708428f7b8ae9736cfc02ace2fdc0040cc15019163fa86fba22147c68d77fc22be95d3343ab6d
-
SSDEEP
3072:sH++bXekOTbSiLvAzII9x66AOag74srxxVfPWKvQIFY623:snbGCqONxTGqQI+62
Malware Config
Extracted
xworm
23.ip.gl.ply.gg:7972
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/272-1-0x0000000000B10000-0x0000000000B56000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2364 powershell.exe 2836 powershell.exe 2944 powershell.exe 2804 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2364 powershell.exe 2836 powershell.exe 2944 powershell.exe 2804 powershell.exe 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe Token: SeDebugPrivilege 2364 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 272 wrote to memory of 2364 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 31 PID 272 wrote to memory of 2364 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 31 PID 272 wrote to memory of 2364 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 31 PID 272 wrote to memory of 2836 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 33 PID 272 wrote to memory of 2836 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 33 PID 272 wrote to memory of 2836 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 33 PID 272 wrote to memory of 2944 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 35 PID 272 wrote to memory of 2944 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 35 PID 272 wrote to memory of 2944 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 35 PID 272 wrote to memory of 2804 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 37 PID 272 wrote to memory of 2804 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 37 PID 272 wrote to memory of 2804 272 53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe"C:\Users\Admin\AppData\Local\Temp\53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD59c04d7581aff93f139da94dc0cef4412
SHA1ee85d7da9aee201f8bb6f31c89c167851a05e222
SHA256ff8371efb6ba508b6409171a6afef6f1b865856c8ac348b3d82fc64d5a5cad57
SHA5128ed26c46eabe16b9ada70302af6a20c0879c8f81e6e1bfb5cdd4d63bbac5d17c9ea6e566f4bb5619ff3a72801ba0179c97dac4d3a7a24c49398220beddef4576