Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2024, 12:28

General

  • Target

    7ab284291b7ad166be5463f93366f54da420d970a7d52e2e740ddf5c6574efb4.exe

  • Size

    56KB

  • MD5

    410b76ca7b805c7ad755519fb93d3740

  • SHA1

    97c61311b9a3633ddadd041f84aedc907eb05f3e

  • SHA256

    7ab284291b7ad166be5463f93366f54da420d970a7d52e2e740ddf5c6574efb4

  • SHA512

    9d4ca5bfc333e951809dc9038b71719bfd901e070f42dc5585ff8a58e6ea7d8a1850bfb1d7454c501f6fd88bbdafa7a42116d454e20e6db1a4a29c24db3abd3d

  • SSDEEP

    1536:ASFTU9xZVqGdtCfBXdi99iQTkbb4IJlqRp2OHLQU:ASFTUNVq04fBti91Tkbb8Rp2OHLQU

Malware Config

Extracted

Family

xworm

C2

Cactus-33152.portmap.host:33152

Attributes
  • Install_directory

    %AppData%

  • install_file

    Teams.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ab284291b7ad166be5463f93366f54da420d970a7d52e2e740ddf5c6574efb4.exe
    "C:\Users\Admin\AppData\Local\Temp\7ab284291b7ad166be5463f93366f54da420d970a7d52e2e740ddf5c6574efb4.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:584
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\Admin\AppData\Roaming\Teams.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1800
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {68139E31-CFCC-4318-8750-A0DA74AD4514} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Roaming\Teams.exe
      C:\Users\Admin\AppData\Roaming\Teams.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
    • C:\Users\Admin\AppData\Roaming\Teams.exe
      C:\Users\Admin\AppData\Roaming\Teams.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Teams.exe

    Filesize

    56KB

    MD5

    410b76ca7b805c7ad755519fb93d3740

    SHA1

    97c61311b9a3633ddadd041f84aedc907eb05f3e

    SHA256

    7ab284291b7ad166be5463f93366f54da420d970a7d52e2e740ddf5c6574efb4

    SHA512

    9d4ca5bfc333e951809dc9038b71719bfd901e070f42dc5585ff8a58e6ea7d8a1850bfb1d7454c501f6fd88bbdafa7a42116d454e20e6db1a4a29c24db3abd3d

  • memory/584-0-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp

    Filesize

    4KB

  • memory/584-1-0x0000000001340000-0x0000000001354000-memory.dmp

    Filesize

    80KB

  • memory/584-6-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

    Filesize

    9.9MB

  • memory/584-7-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp

    Filesize

    4KB

  • memory/584-8-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

    Filesize

    9.9MB

  • memory/1568-15-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

    Filesize

    80KB

  • memory/2572-12-0x0000000000B40000-0x0000000000B54000-memory.dmp

    Filesize

    80KB