Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2024, 16:20
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
61dec39ff827ef9850ed12f932ab22ed
-
SHA1
0fbf2330c943bdc02078dde76e8abdfe2718f779
-
SHA256
630b2a1ee3471f27100a0937e137b8eb020bda08d8bb8f77dfa6075676443da8
-
SHA512
09b2792d136b0a46178d5519cc3516a0910294921cba3f349a8154adbc2d2eb1be3bec6106fba97574c8c128c86963185cafded90443e0df145530bdd363d9cd
-
SSDEEP
768:FXJVfQAQ/PWNDflzs0rGZFh9A+6O/ho/h+a:FZVfQAMKs0rmFh9A+6O/e8a
Malware Config
Extracted
xworm
3.1
45.139.196.188:30120
LGW1OffJggMqu1JK
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/4708-1-0x0000000000740000-0x000000000074E000-memory.dmp family_xworm behavioral1/files/0x000a000000023b6a-21.dat family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4708 XClient.exe Token: SeDebugPrivilege 4596 taskmgr.exe Token: SeSystemProfilePrivilege 4596 taskmgr.exe Token: SeCreateGlobalPrivilege 4596 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4024 4708 XClient.exe 90 PID 4708 wrote to memory of 4024 4708 XClient.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4024
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4596
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771B
MD5db7e00b30434d55ac603cc3ec5ef0128
SHA1d01137ba29ac4bc3952023ee6afcead00f62326d
SHA256a69cab4ed3fef63731263b8ed3ecc777eb3be4a539826b9a44b1acbbe7d363be
SHA512440c08187faae47e54b6935bd619877b21a375ef8b20eccb056204da571dea269919a120d89add9b7c3d7b3fe696c92d9ebf7dfb5e46b7711a67b9d3c9afa98c
-
Filesize
32KB
MD561dec39ff827ef9850ed12f932ab22ed
SHA10fbf2330c943bdc02078dde76e8abdfe2718f779
SHA256630b2a1ee3471f27100a0937e137b8eb020bda08d8bb8f77dfa6075676443da8
SHA51209b2792d136b0a46178d5519cc3516a0910294921cba3f349a8154adbc2d2eb1be3bec6106fba97574c8c128c86963185cafded90443e0df145530bdd363d9cd