Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
1Extra Xite...V5.exe
windows10-2004-x64
1Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/11/2024, 18:48
Behavioral task
behavioral1
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Extra Xiters Premium V5.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Windows Shell Experience Host.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Windows Shell Experience Host.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
Realtek HD Audio Universal Service.exe
-
Size
53KB
-
MD5
ce3e5f8613ea049b651549eba3e3aa28
-
SHA1
1197375be314ae5a69f3b742f0f539b881aca09a
-
SHA256
9385116a4a3874548ffa027f4cd448d860ef8dc13fc687ce87790a01ede8e73a
-
SHA512
ab1428177b5ec71447003ac01f5f99d9c7f2af634f17ef53d6f6be196714faac856b0bc3f62b6fad9975dad970ec247d35f56615c62b9ad483426f4ecaae71c2
-
SSDEEP
768:/63AQe9cfNbv5s7Xol68y+JN/Db3dLPowu7aR6vaTOouhIZqklm:/WAQbdvoolZJ9b3dLPoCR68OnkZ8
Malware Config
Extracted
xworm
147.185.221.23:58112
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral11/memory/2232-1-0x00000000003D0000-0x00000000003E4000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2776 powershell.exe 2580 powershell.exe 576 powershell.exe 2128 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Service.exe" Realtek HD Audio Universal Service.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2776 powershell.exe 2580 powershell.exe 576 powershell.exe 2128 powershell.exe 2232 Realtek HD Audio Universal Service.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2232 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 576 powershell.exe Token: SeDebugPrivilege 2128 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2232 Realtek HD Audio Universal Service.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2776 2232 Realtek HD Audio Universal Service.exe 31 PID 2232 wrote to memory of 2776 2232 Realtek HD Audio Universal Service.exe 31 PID 2232 wrote to memory of 2776 2232 Realtek HD Audio Universal Service.exe 31 PID 2232 wrote to memory of 2580 2232 Realtek HD Audio Universal Service.exe 33 PID 2232 wrote to memory of 2580 2232 Realtek HD Audio Universal Service.exe 33 PID 2232 wrote to memory of 2580 2232 Realtek HD Audio Universal Service.exe 33 PID 2232 wrote to memory of 576 2232 Realtek HD Audio Universal Service.exe 35 PID 2232 wrote to memory of 576 2232 Realtek HD Audio Universal Service.exe 35 PID 2232 wrote to memory of 576 2232 Realtek HD Audio Universal Service.exe 35 PID 2232 wrote to memory of 2128 2232 Realtek HD Audio Universal Service.exe 37 PID 2232 wrote to memory of 2128 2232 Realtek HD Audio Universal Service.exe 37 PID 2232 wrote to memory of 2128 2232 Realtek HD Audio Universal Service.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Service.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD58767a011c503950e9e0f1666b1d91d0e
SHA12bb3614a853fc4bdc48cfaee7dd173fd0f493338
SHA2565749ff37113068074832dbcce380359570c43d12e990733f52c01dec0c0e92d7
SHA512c6dd0d4e3a14b67c605fbd4c3e596994ca7bdb14257b0fa3cbbb9c6dcaf40bae08589490f62a76b42122cc6486bb4fd42f22a753c356cccca93c67d8ee3b5813