Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2024, 18:35

General

  • Target

    SAM X222C#.exe

  • Size

    3.3MB

  • MD5

    631c497597c5c12304d528b24ccc31df

  • SHA1

    9da881cd6797e4e8646de4df60eea73ae45c3133

  • SHA256

    239584ed2b45abd89565c75968a8ca7d0624b2df851463f80a485e1efc04d9e4

  • SHA512

    35a6bb13ff373aebb2a6fc080ea0f69e968fbef3441ce7f69604e5f97645ae9e6feb95bad1058fa58f8e652dcc2befd6464d9f62d707d8115c743c57a912957e

  • SSDEEP

    98304:gm7q1K/hJp6SjJjtPzGhHzKIfx+ceJpTYZ:x7q1Irp9jltPahVfx+ceJtYZ

Malware Config

Extracted

Family

xworm

Version

5.0

C2

testarosa.duckdns.org:7119

Mutex

Ljk1RFh4f0rbZvhE

Attributes
  • Install_directory

    %Temp%

  • install_file

    Realtec.exe

aes.plain

Extracted

Family

xworm

C2

147.185.221.23:25808

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    Realtek HD Audio Universal Service.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe
    "C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\AppData\Roaming\SAM X222C#.exe
      "C:\Users\Admin\AppData\Roaming\SAM X222C#.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3812
      • C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe
        "C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:3056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Realtek HD Audio Universal Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3260
      • C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe
        "C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
    • C:\Users\Admin\AppData\Roaming\Realtek.exe
      "C:\Users\Admin\AppData\Roaming\Realtek.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtec.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtec.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1740
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Realtec" /tr "C:\Users\Admin\AppData\Local\Temp\Realtec.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1404
  • C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1000
  • C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4716
  • C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    C:\Users\Admin\AppData\Local\Temp\Realtec.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SAM X222C#.exe.log

    Filesize

    654B

    MD5

    2ff39f6c7249774be85fd60a8f9a245e

    SHA1

    684ff36b31aedc1e587c8496c02722c6698c1c4e

    SHA256

    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

    SHA512

    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    21a9418825c5bd0d3d4e27e07a7fdb46

    SHA1

    2b1742947788771ed20ee55ffc7e222ec4568de8

    SHA256

    bb073567f10e4d90910b9a7f6c2ecce180e10630491431c6e2974f9699d65137

    SHA512

    cda334632ea4ba343d6e3c15683bbdac0adfe1d536d525965bde33813e1a1e6cb6662e62c8aeba505a7077c5fd9698b2ffc8acaf2f52f749e4ce0efd6f8aaac4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    ce4540390cc4841c8973eb5a3e9f4f7d

    SHA1

    2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

    SHA256

    e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

    SHA512

    2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    e60eb305a7b2d9907488068b7065abd3

    SHA1

    1643dd7f915ac50c75bc01c53d68c5dafb9ce28d

    SHA256

    ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135

    SHA512

    95c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    77d622bb1a5b250869a3238b9bc1402b

    SHA1

    d47f4003c2554b9dfc4c16f22460b331886b191b

    SHA256

    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

    SHA512

    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    b4b6d4cc52b5a3a71149b1f33d94d5de

    SHA1

    97d3dbdd24919eab70e3b14c68797cefc07e90dd

    SHA256

    da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe

    SHA512

    fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af

  • C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe

    Filesize

    79KB

    MD5

    066d90fb1d671648842a3b46622eb7ce

    SHA1

    6d0949bd4f494c9f8d80b705a79cfa9038c80e51

    SHA256

    8d2cf02c3005fb4bb7058df1f3a2e24b98077a8c5a8aab5c8184f4aa9ed951d8

    SHA512

    b22c8910e501de5fcb8e6197552396285366c9b43c4c6df4387b95a28830bf13a6ce634aadbf79e71b83879d19132c63414da5c5059edaa33be6bb71cee32745

  • C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe

    Filesize

    3.7MB

    MD5

    ad991add5af431b8d808cf9035a5cd46

    SHA1

    d7ac382fa834529219db1b76e4d928ff24f1245b

    SHA256

    a1dfdf32f2a82156bb3007896a9672fa05aba8ce4c668c3f4dce449a1a811a19

    SHA512

    b876e8380ab97dade3f875a7e0cee2dc598ba55143921bdd1f1d9d2d5be55c25d62b12aaef424227e1450f6ddf67a4e04e3f4fc846182abb842c4c821997cbbd

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yw3zajs0.3j2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Realtek.exe

    Filesize

    39KB

    MD5

    27794afa5d5c5cf091e80de14bdb218a

    SHA1

    ec07edcd5c705ae72a7d477f0ffeb867ea7eb5db

    SHA256

    502c51b32b810e755b91cfd9a11230f6e0bf3baceda87f527f4ccc555aac9946

    SHA512

    667de7a923e39214db1f40175984832098b4a75869c145888536e21ec1fa6a36777e5c0b6d89669611377b19b04b8c818fdb05a2db1c94ab135bc796167a2491

  • C:\Users\Admin\AppData\Roaming\SAM X222C#.exe

    Filesize

    3.3MB

    MD5

    918951c4657e9cdf39ac1b275bfd2e95

    SHA1

    7323e59b2c4d60b6639bfcba11f4c02bcb94e347

    SHA256

    b50d25c24ba5f1f096e883b3a9970d2c080afb37dfe2f55a25a1c7ed3ca36505

    SHA512

    438c7554d8b72db63d598085b2c6fae9bfa1895154ebbaf96a5d2a498459b9a3516611613515f04dbc198edb8b2d7ce2ce63975064f28af63f3efa1e50e3e0d7

  • memory/700-52-0x000001B3AB1B0000-0x000001B3AB1D2000-memory.dmp

    Filesize

    136KB

  • memory/1548-0-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

    Filesize

    8KB

  • memory/1548-1-0x0000000000160000-0x00000000004BC000-memory.dmp

    Filesize

    3.4MB

  • memory/1652-51-0x000001F47F8D0000-0x000001F47F90C000-memory.dmp

    Filesize

    240KB

  • memory/1652-50-0x000001F47F940000-0x000001F47FB54000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-49-0x000001F47EAA0000-0x000001F47EAB2000-memory.dmp

    Filesize

    72KB

  • memory/1652-48-0x000001F47E310000-0x000001F47E6D4000-memory.dmp

    Filesize

    3.8MB

  • memory/2604-43-0x0000000000190000-0x00000000001AA000-memory.dmp

    Filesize

    104KB

  • memory/4748-23-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

    Filesize

    10.8MB

  • memory/4748-22-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/4748-135-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

    Filesize

    10.8MB

  • memory/4748-137-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

    Filesize

    10.8MB

  • memory/4748-138-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

    Filesize

    10.8MB