Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/11/2024, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
AdminTools.rar.exe
Resource
win7-20240903-en
General
-
Target
AdminTools.rar.exe
-
Size
11.8MB
-
MD5
ddcffb7143bb8073f53391fd44159950
-
SHA1
e55cfccc6eefd6c8079f6e18459a3eb509107bd2
-
SHA256
ddfe0cfb0d6ff02a67de60e59a1f212403d075eb1afebccb7e21e094d463a33a
-
SHA512
1538f3ee18787485e727904eeac50ea6dbf207ff5aa61620223a33aa5c7c743d17c1ab9c499f04cb6e3954c28434f0dd01ef94412e2a62a94e77d9f996a8db27
-
SSDEEP
196608:lQXFWvrR+RBZuLVESPp94EMtwBVxCS8ns71EWradV3qAo5QiPZbdBD8h5sf0IfvB:l/URsVz2Z6BVxGmbeV3qc35sfFRf
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
FDifYDumKCtsXZEN
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000015d07-7.dat family_xworm behavioral1/memory/2248-8-0x0000000001310000-0x000000000131E000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 2248 XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2708 2328 AdminTools.rar.exe 30 PID 2328 wrote to memory of 2708 2328 AdminTools.rar.exe 30 PID 2328 wrote to memory of 2708 2328 AdminTools.rar.exe 30 PID 2328 wrote to memory of 2248 2328 AdminTools.rar.exe 31 PID 2328 wrote to memory of 2248 2328 AdminTools.rar.exe 31 PID 2328 wrote to memory of 2248 2328 AdminTools.rar.exe 31 PID 2708 wrote to memory of 2884 2708 rundll32.exe 33 PID 2708 wrote to memory of 2884 2708 rundll32.exe 33 PID 2708 wrote to memory of 2884 2708 rundll32.exe 33 PID 2884 wrote to memory of 2744 2884 rundll32.exe 34 PID 2884 wrote to memory of 2744 2884 rundll32.exe 34 PID 2884 wrote to memory of 2744 2884 rundll32.exe 34 PID 2744 wrote to memory of 2808 2744 rundll32.exe 35 PID 2744 wrote to memory of 2808 2744 rundll32.exe 35 PID 2744 wrote to memory of 2808 2744 rundll32.exe 35 PID 2808 wrote to memory of 2624 2808 rundll32.exe 36 PID 2808 wrote to memory of 2624 2808 rundll32.exe 36 PID 2808 wrote to memory of 2624 2808 rundll32.exe 36 PID 2624 wrote to memory of 2828 2624 rundll32.exe 37 PID 2624 wrote to memory of 2828 2624 rundll32.exe 37 PID 2624 wrote to memory of 2828 2624 rundll32.exe 37 PID 2828 wrote to memory of 1964 2828 rundll32.exe 38 PID 2828 wrote to memory of 1964 2828 rundll32.exe 38 PID 2828 wrote to memory of 1964 2828 rundll32.exe 38 PID 1964 wrote to memory of 3020 1964 rundll32.exe 39 PID 1964 wrote to memory of 3020 1964 rundll32.exe 39 PID 1964 wrote to memory of 3020 1964 rundll32.exe 39 PID 3020 wrote to memory of 3040 3020 rundll32.exe 40 PID 3020 wrote to memory of 3040 3020 rundll32.exe 40 PID 3020 wrote to memory of 3040 3020 rundll32.exe 40 PID 3040 wrote to memory of 2968 3040 rundll32.exe 41 PID 3040 wrote to memory of 2968 3040 rundll32.exe 41 PID 3040 wrote to memory of 2968 3040 rundll32.exe 41 PID 2968 wrote to memory of 1984 2968 rundll32.exe 42 PID 2968 wrote to memory of 1984 2968 rundll32.exe 42 PID 2968 wrote to memory of 1984 2968 rundll32.exe 42 PID 1984 wrote to memory of 2148 1984 rundll32.exe 43 PID 1984 wrote to memory of 2148 1984 rundll32.exe 43 PID 1984 wrote to memory of 2148 1984 rundll32.exe 43 PID 2148 wrote to memory of 1728 2148 rundll32.exe 44 PID 2148 wrote to memory of 1728 2148 rundll32.exe 44 PID 2148 wrote to memory of 1728 2148 rundll32.exe 44 PID 1728 wrote to memory of 848 1728 rundll32.exe 45 PID 1728 wrote to memory of 848 1728 rundll32.exe 45 PID 1728 wrote to memory of 848 1728 rundll32.exe 45 PID 848 wrote to memory of 1784 848 rundll32.exe 46 PID 848 wrote to memory of 1784 848 rundll32.exe 46 PID 848 wrote to memory of 1784 848 rundll32.exe 46 PID 1784 wrote to memory of 1892 1784 rundll32.exe 47 PID 1784 wrote to memory of 1892 1784 rundll32.exe 47 PID 1784 wrote to memory of 1892 1784 rundll32.exe 47 PID 1892 wrote to memory of 2028 1892 rundll32.exe 48 PID 1892 wrote to memory of 2028 1892 rundll32.exe 48 PID 1892 wrote to memory of 2028 1892 rundll32.exe 48 PID 2028 wrote to memory of 1248 2028 rundll32.exe 49 PID 2028 wrote to memory of 1248 2028 rundll32.exe 49 PID 2028 wrote to memory of 1248 2028 rundll32.exe 49 PID 1248 wrote to memory of 1092 1248 rundll32.exe 50 PID 1248 wrote to memory of 1092 1248 rundll32.exe 50 PID 1248 wrote to memory of 1092 1248 rundll32.exe 50 PID 1092 wrote to memory of 2568 1092 rundll32.exe 51 PID 1092 wrote to memory of 2568 1092 rundll32.exe 51 PID 1092 wrote to memory of 2568 1092 rundll32.exe 51 PID 2568 wrote to memory of 344 2568 rundll32.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdminTools.rar.exe"C:\Users\Admin\AppData\Local\Temp\AdminTools.rar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar4⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar5⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar6⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar7⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar8⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar9⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar10⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar11⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar12⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar13⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar14⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar15⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar16⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar17⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar18⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar19⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar20⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar21⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar22⤵
- Modifies registry class
PID:344 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar23⤵
- Modifies registry class
PID:2436 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar24⤵
- Modifies registry class
PID:2504 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Admin Tools.rar25⤵
- Modifies registry class
PID:336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c8adc1201433e732c762f4cca0ef59d5
SHA10ef49322427eee1735d2cd943d645453edbbc173
SHA2560a66ae70b388aaa6ca8228d829345728739b631586440672faf0f9dd894cb994
SHA5128f5d476a637da21a37f6b160b7a6281bc2aa952905ef06a61aa8b2851c5edf67b1528a7c46b6295856751b79de079aa05aea371cb7211074adcd97b3e537295e