Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
Resource
win10v2004-20241007-en
General
-
Target
4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
-
Size
116KB
-
MD5
4f0c8a81138b78a1f40ef1d383632130
-
SHA1
96b6c6ff5c5b1aa90014e975bb851d23acbed598
-
SHA256
4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42
-
SHA512
687dddf2a070acbb5eee3af912dc1461968a67b05992f76f5a77a5bb0d773ae1049c7e44386c4a44d5971ace7784a8601c2fc3f47f1f8dbbb06a7e04646bbf1c
-
SSDEEP
3072:oziOToQz31V4b1pCoLd7H7dwsIc6rmGBLYdLrfncO:+ToQzFjox7bCs5WmGVYVrfn
Malware Config
Extracted
xworm
left-noon.gl.at.ply.gg:60705
-
Install_directory
%AppData%
-
install_file
US11B.exe
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/files/0x000a0000000122d0-18.dat family_xworm behavioral1/memory/2216-21-0x0000000000A20000-0x0000000000A3A000-memory.dmp family_xworm behavioral1/memory/2040-53-0x00000000012A0000-0x00000000012BA000-memory.dmp family_xworm behavioral1/memory/1164-56-0x0000000001310000-0x000000000132A000-memory.dmp family_xworm behavioral1/memory/780-58-0x00000000013B0000-0x00000000013CA000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2868 powershell.exe 1444 powershell.exe 2584 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smsD079.lnk smsD079.tmp File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smsD079.lnk smsD079.tmp -
Executes dropped EXE 4 IoCs
pid Process 2216 smsD079.tmp 2040 smsD079.tmp 1164 smsD079.tmp 780 smsD079.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\smsD079 = "C:\\Users\\Admin\\AppData\\Roaming\\smsD079.tmp" smsD079.tmp -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 smsD079.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 smsD079.tmp -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2728 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2868 powershell.exe 1444 powershell.exe 2584 powershell.exe 2216 smsD079.tmp -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2216 smsD079.tmp Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2216 smsD079.tmp Token: SeDebugPrivilege 2040 smsD079.tmp Token: SeDebugPrivilege 1164 smsD079.tmp Token: SeDebugPrivilege 780 smsD079.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2216 smsD079.tmp -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2336 wrote to memory of 2364 2336 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 31 PID 2364 wrote to memory of 2216 2364 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 32 PID 2364 wrote to memory of 2216 2364 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 32 PID 2364 wrote to memory of 2216 2364 4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe 32 PID 2216 wrote to memory of 2868 2216 smsD079.tmp 35 PID 2216 wrote to memory of 2868 2216 smsD079.tmp 35 PID 2216 wrote to memory of 2868 2216 smsD079.tmp 35 PID 2216 wrote to memory of 1444 2216 smsD079.tmp 37 PID 2216 wrote to memory of 1444 2216 smsD079.tmp 37 PID 2216 wrote to memory of 1444 2216 smsD079.tmp 37 PID 2216 wrote to memory of 2584 2216 smsD079.tmp 39 PID 2216 wrote to memory of 2584 2216 smsD079.tmp 39 PID 2216 wrote to memory of 2584 2216 smsD079.tmp 39 PID 2216 wrote to memory of 2728 2216 smsD079.tmp 41 PID 2216 wrote to memory of 2728 2216 smsD079.tmp 41 PID 2216 wrote to memory of 2728 2216 smsD079.tmp 41 PID 2032 wrote to memory of 2040 2032 taskeng.exe 44 PID 2032 wrote to memory of 2040 2032 taskeng.exe 44 PID 2032 wrote to memory of 2040 2032 taskeng.exe 44 PID 2032 wrote to memory of 1164 2032 taskeng.exe 45 PID 2032 wrote to memory of 1164 2032 taskeng.exe 45 PID 2032 wrote to memory of 1164 2032 taskeng.exe 45 PID 2032 wrote to memory of 780 2032 taskeng.exe 46 PID 2032 wrote to memory of 780 2032 taskeng.exe 46 PID 2032 wrote to memory of 780 2032 taskeng.exe 46 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"C:\Users\Admin\AppData\Local\Temp\4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\smsD079.tmp"C:\Users\Admin\AppData\Local\Temp\smsD079.tmp"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\smsD079.tmp'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'smsD079.tmp'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\smsD079.tmp'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "smsD079" /tr "C:\Users\Admin\AppData\Roaming\smsD079.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2728
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {95A93214-911E-4831-943A-C23BF598895B} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Roaming\smsD079.tmpC:\Users\Admin\AppData\Roaming\smsD079.tmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
C:\Users\Admin\AppData\Roaming\smsD079.tmpC:\Users\Admin\AppData\Roaming\smsD079.tmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Users\Admin\AppData\Roaming\smsD079.tmpC:\Users\Admin\AppData\Roaming\smsD079.tmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD58032a5e68376a879472c297749cdb4c4
SHA1d6a96c5287f1d76b41f605ecaeb1688d208c720a
SHA256fa3dd88248218cd597232333c70e0996801817b003c234994102452712a23d1d
SHA512b75d6429844e643fc7920efe1d30b15b0e631ded561f5f0021e105a68a729ebf308a23501c9136efbf4637bb068dba5c0056ff85195cd54d56e05205193d6c21
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZRIZ55VX46SIPMRSNC4T.temp
Filesize7KB
MD5670dea76b667291acaa1a757332c005d
SHA1d5bfe092815d112c64eef3bec963146b487c7806
SHA2567c963706d34043c7925be006a05c69bec76f8d1b7493141757f27896f5a5f750
SHA512caf8638f10ea09032023f0534306b17576feb64b1caf3731b2fc4127519bed12bd7dc19f3c50e258c1cd1ddfdb36883b12f0bc60368a76f5d536779147a1c68d