Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClient.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/11/2024, 14:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    83KB

  • MD5

    a553d650efef4d852fb707270a57f6b8

  • SHA1

    80dfd72248fc1522b1f6cacf24b4258865e5bce4

  • SHA256

    4d87eb4b63dee3832f8a94445e8d5b7c8f1d5335650d0fab2b6bfdc3d6b591d2

  • SHA512

    6132fb8204e6a4fff10f9788abb63840f0d34f752f0c28aa9c49a21c38ffa14a6aa0b8bcdfad887e84aa24297dcbdacf46608ad0eada859b85cab95b4cadfd46

  • SSDEEP

    1536:xSteEftgm7/FDdQv78wWbG3NycZ8TufTa3sQwYPo62+2ONvNIAsF:3OldgAdbG3NV6gSqONvN8F

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

another-limits.gl.at.ply.gg:63201

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    $77wsappx.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\$77wsappx.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77wsappx.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:396
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77wsappx" /tr "C:\ProgramData\$77wsappx.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1948
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4956
  • C:\ProgramData\$77wsappx.exe
    C:\ProgramData\$77wsappx.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4256
  • C:\ProgramData\$77wsappx.exe
    C:\ProgramData\$77wsappx.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\$77wsappx.exe
    Filesize

    83KB

    MD5

    a553d650efef4d852fb707270a57f6b8

    SHA1

    80dfd72248fc1522b1f6cacf24b4258865e5bce4

    SHA256

    4d87eb4b63dee3832f8a94445e8d5b7c8f1d5335650d0fab2b6bfdc3d6b591d2

    SHA512

    6132fb8204e6a4fff10f9788abb63840f0d34f752f0c28aa9c49a21c38ffa14a6aa0b8bcdfad887e84aa24297dcbdacf46608ad0eada859b85cab95b4cadfd46

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77wsappx.exe.log
    Filesize

    654B

    MD5

    2cbbb74b7da1f720b48ed31085cbd5b8

    SHA1

    79caa9a3ea8abe1b9c4326c3633da64a5f724964

    SHA256

    e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

    SHA512

    ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    1a9fa92a4f2e2ec9e244d43a6a4f8fb9

    SHA1

    9910190edfaccece1dfcc1d92e357772f5dae8f7

    SHA256

    0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

    SHA512

    5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    e47c3fa11e796c492a8388c946bf1636

    SHA1

    4a090378f0db26c6f019c9203f5b27f12fa865c7

    SHA256

    4bb861850395dcc3bec4691e8b9f0fa733b8a2d568d460a9201d65250b12fee1

    SHA512

    8d4af4eba3019cd060561f42cff11374eafe59da5e5ad677e41d0b9198b87d6d13706e760d13c70574ed1384993a1597f886d21fe6ecd0186379a1e93db30695

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    21017c68eaf9461301de459f4f07e888

    SHA1

    41ff30fc8446508d4c3407c79e798cf6eaa5bb73

    SHA256

    03b321e48ff3328d9c230308914961fe110c4c7bc96c0a85a296745437bcb888

    SHA512

    956990c11c6c1baa3665ef7ef23ef6073e0a7fcff77a93b5e605a83ff1e60b916d80d45dafb06977aed90868a273569a865cf2c623e295b5157bfff0fb2be35d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43lh15au.xkr.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77wsappx.lnk
    Filesize

    682B

    MD5

    70c9c7aaf19350f49763acd377035425

    SHA1

    c06836b54ed4feccd8f95da3857e42438a6c8c57

    SHA256

    b315ca30eb1f1f5a6352e650b25a2a4b82e2efe6f444b7589522a15ca2febabf

    SHA512

    079f29ee35cd040d16dfa6a4092914a3b98d4e9a2c1ae4a7decdf631dd1ca8aa2227093b689951ea15539c01d8ef3d60b341830be63928ce86071bc85abb84e4

    Download Submit

  • memory/2076-13-0x00000200C4980000-0x00000200C49A2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2076-17-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-20-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-14-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-4-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-3-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-15-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3180-16-0x00007FFD22C13000-0x00007FFD22C15000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3180-2-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3180-56-0x00007FFD22C10000-0x00007FFD236D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3180-0-0x00007FFD22C13000-0x00007FFD22C15000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3180-1-0x00000000007B0000-0x00000000007CC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4956-57-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-65-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-68-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-69-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-67-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-66-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-64-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-63-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-58-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4956-59-0x000001FBB7D80000-0x000001FBB7D81000-memory.dmp

    Filesize

    4KB

    Download