Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
1Extra Xite...V5.exe
windows10-2004-x64
1Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/11/2024, 18:48
Behavioral task
behavioral1
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Extra Xiters Premium V5.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Windows Shell Experience Host.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Windows Shell Experience Host.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
Windows Shell Experience Host.exe
-
Size
86KB
-
MD5
17f122079462e212871a1e2eb20eaff9
-
SHA1
349e4b54323acce835916a2bbe40dc9c5d30931f
-
SHA256
f483197df60b8767d23fa820efaab0c6bcc3a4b02ebee3c8f1290ef699f6697e
-
SHA512
95548cb30e9e45c4024be181253200d2188b622754158f6268fa09e41327dbb8468399a1b5ddd9d868413638bf1b9b18f6814586530f2c6a0a6cbd6311234e94
-
SSDEEP
768:NG9nICDiZGhCMhOB0s1SbiFG9Ox7h86BOMhUL02dC+IHZK:NgICDiZQRhVeFG9e7h86BOM+Nd6c
Malware Config
Extracted
xworm
5.0
147.185.221.20:65300
RMe1pa1UgjNcB2Un
-
Install_directory
%AppData%
-
install_file
Windows Shell Experience Host.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral9/memory/2032-1-0x0000000000A00000-0x0000000000A1A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2708 powershell.exe 2760 powershell.exe 3068 powershell.exe 2988 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Shell Experience Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Shell Experience Host.exe" Windows Shell Experience Host.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2988 powershell.exe 2708 powershell.exe 2760 powershell.exe 3068 powershell.exe 2032 Windows Shell Experience Host.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2032 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 3068 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2032 Windows Shell Experience Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2988 2032 Windows Shell Experience Host.exe 31 PID 2032 wrote to memory of 2988 2032 Windows Shell Experience Host.exe 31 PID 2032 wrote to memory of 2988 2032 Windows Shell Experience Host.exe 31 PID 2032 wrote to memory of 2708 2032 Windows Shell Experience Host.exe 33 PID 2032 wrote to memory of 2708 2032 Windows Shell Experience Host.exe 33 PID 2032 wrote to memory of 2708 2032 Windows Shell Experience Host.exe 33 PID 2032 wrote to memory of 2760 2032 Windows Shell Experience Host.exe 35 PID 2032 wrote to memory of 2760 2032 Windows Shell Experience Host.exe 35 PID 2032 wrote to memory of 2760 2032 Windows Shell Experience Host.exe 35 PID 2032 wrote to memory of 3068 2032 Windows Shell Experience Host.exe 37 PID 2032 wrote to memory of 3068 2032 Windows Shell Experience Host.exe 37 PID 2032 wrote to memory of 3068 2032 Windows Shell Experience Host.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Shell Experience Host.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BBJ98O0VJPZP2ZGI6YOR.temp
Filesize7KB
MD56d0ef08fb863a3ba1a85b53db2a6baab
SHA1e94cb8ebfaa9fa4a964e9e86b193e4c59641fff5
SHA2569555b7ece3afe725b7beeb03fe12b0a0214fa427305f148c867c7b8841efd725
SHA51225bc722e324ec5de43bd2a3f971851b18d2d6db798c9973b5edece3ce6194ebf6d6ea058900b2a179f238322499e58250e45af2f89f05bf35da567c59afddb06