Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2024, 16:20

General

  • Target

    XClient.exe

  • Size

    32KB

  • MD5

    61dec39ff827ef9850ed12f932ab22ed

  • SHA1

    0fbf2330c943bdc02078dde76e8abdfe2718f779

  • SHA256

    630b2a1ee3471f27100a0937e137b8eb020bda08d8bb8f77dfa6075676443da8

  • SHA512

    09b2792d136b0a46178d5519cc3516a0910294921cba3f349a8154adbc2d2eb1be3bec6106fba97574c8c128c86963185cafded90443e0df145530bdd363d9cd

  • SSDEEP

    768:FXJVfQAQ/PWNDflzs0rGZFh9A+6O/ho/h+a:FZVfQAMKs0rmFh9A+6O/e8a

Malware Config

Extracted

Family

xworm

Version

3.1

C2

45.139.196.188:30120

Mutex

LGW1OffJggMqu1JK

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4024
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

    Filesize

    771B

    MD5

    db7e00b30434d55ac603cc3ec5ef0128

    SHA1

    d01137ba29ac4bc3952023ee6afcead00f62326d

    SHA256

    a69cab4ed3fef63731263b8ed3ecc777eb3be4a539826b9a44b1acbbe7d363be

    SHA512

    440c08187faae47e54b6935bd619877b21a375ef8b20eccb056204da571dea269919a120d89add9b7c3d7b3fe696c92d9ebf7dfb5e46b7711a67b9d3c9afa98c

  • C:\Users\Admin\AppData\Roaming\XClient.exe

    Filesize

    32KB

    MD5

    61dec39ff827ef9850ed12f932ab22ed

    SHA1

    0fbf2330c943bdc02078dde76e8abdfe2718f779

    SHA256

    630b2a1ee3471f27100a0937e137b8eb020bda08d8bb8f77dfa6075676443da8

    SHA512

    09b2792d136b0a46178d5519cc3516a0910294921cba3f349a8154adbc2d2eb1be3bec6106fba97574c8c128c86963185cafded90443e0df145530bdd363d9cd

  • memory/4596-7-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-14-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-6-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-18-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-17-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-16-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-15-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-8-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-13-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4596-12-0x000001783A040000-0x000001783A041000-memory.dmp

    Filesize

    4KB

  • memory/4708-0-0x00007FFFFBD73000-0x00007FFFFBD75000-memory.dmp

    Filesize

    8KB

  • memory/4708-23-0x00007FFFFBD70000-0x00007FFFFC831000-memory.dmp

    Filesize

    10.8MB

  • memory/4708-24-0x00007FFFFBD73000-0x00007FFFFBD75000-memory.dmp

    Filesize

    8KB

  • memory/4708-1-0x0000000000740000-0x000000000074E000-memory.dmp

    Filesize

    56KB

  • memory/4708-27-0x00007FFFFBD70000-0x00007FFFFC831000-memory.dmp

    Filesize

    10.8MB