Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2024, 01:14

General

  • Target

    4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe

  • Size

    116KB

  • MD5

    4f0c8a81138b78a1f40ef1d383632130

  • SHA1

    96b6c6ff5c5b1aa90014e975bb851d23acbed598

  • SHA256

    4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42

  • SHA512

    687dddf2a070acbb5eee3af912dc1461968a67b05992f76f5a77a5bb0d773ae1049c7e44386c4a44d5971ace7784a8601c2fc3f47f1f8dbbb06a7e04646bbf1c

  • SSDEEP

    3072:oziOToQz31V4b1pCoLd7H7dwsIc6rmGBLYdLrfncO:+ToQzFjox7bCs5WmGVYVrfn

Malware Config

Extracted

Family

xworm

C2

left-noon.gl.at.ply.gg:60705

Attributes
  • Install_directory

    %AppData%

  • install_file

    US11B.exe

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
    "C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
      "C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\smsD079.tmp
        "C:\Users\Admin\AppData\Local\Temp\smsD079.tmp"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2216
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\smsD079.tmp'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'smsD079.tmp'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\smsD079.tmp'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2584
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "smsD079" /tr "C:\Users\Admin\AppData\Roaming\smsD079.tmp"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2728
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {95A93214-911E-4831-943A-C23BF598895B} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Roaming\smsD079.tmp
      C:\Users\Admin\AppData\Roaming\smsD079.tmp
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2040
    • C:\Users\Admin\AppData\Roaming\smsD079.tmp
      C:\Users\Admin\AppData\Roaming\smsD079.tmp
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1164
    • C:\Users\Admin\AppData\Roaming\smsD079.tmp
      C:\Users\Admin\AppData\Roaming\smsD079.tmp
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\smsD079.tmp

    Filesize

    77KB

    MD5

    8032a5e68376a879472c297749cdb4c4

    SHA1

    d6a96c5287f1d76b41f605ecaeb1688d208c720a

    SHA256

    fa3dd88248218cd597232333c70e0996801817b003c234994102452712a23d1d

    SHA512

    b75d6429844e643fc7920efe1d30b15b0e631ded561f5f0021e105a68a729ebf308a23501c9136efbf4637bb068dba5c0056ff85195cd54d56e05205193d6c21

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZRIZ55VX46SIPMRSNC4T.temp

    Filesize

    7KB

    MD5

    670dea76b667291acaa1a757332c005d

    SHA1

    d5bfe092815d112c64eef3bec963146b487c7806

    SHA256

    7c963706d34043c7925be006a05c69bec76f8d1b7493141757f27896f5a5f750

    SHA512

    caf8638f10ea09032023f0534306b17576feb64b1caf3731b2fc4127519bed12bd7dc19f3c50e258c1cd1ddfdb36883b12f0bc60368a76f5d536779147a1c68d

  • memory/780-58-0x00000000013B0000-0x00000000013CA000-memory.dmp

    Filesize

    104KB

  • memory/1164-56-0x0000000001310000-0x000000000132A000-memory.dmp

    Filesize

    104KB

  • memory/1444-34-0x000000001B780000-0x000000001BA62000-memory.dmp

    Filesize

    2.9MB

  • memory/1444-35-0x0000000000560000-0x0000000000568000-memory.dmp

    Filesize

    32KB

  • memory/2040-53-0x00000000012A0000-0x00000000012BA000-memory.dmp

    Filesize

    104KB

  • memory/2216-21-0x0000000000A20000-0x0000000000A3A000-memory.dmp

    Filesize

    104KB

  • memory/2216-22-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

    Filesize

    9.9MB

  • memory/2216-49-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

    Filesize

    9.9MB

  • memory/2216-20-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

    Filesize

    4KB

  • memory/2216-45-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

    Filesize

    4KB

  • memory/2336-14-0x000000013FBF0000-0x000000013FC1A000-memory.dmp

    Filesize

    168KB

  • memory/2364-11-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-5-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-7-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

    Filesize

    4KB

  • memory/2364-8-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-4-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

    Filesize

    4KB

  • memory/2364-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-13-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-2-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2364-15-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2868-27-0x000000001B6A0000-0x000000001B982000-memory.dmp

    Filesize

    2.9MB

  • memory/2868-28-0x0000000002820000-0x0000000002828000-memory.dmp

    Filesize

    32KB