Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
297s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/01/2025, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
injection.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
injection.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
injection.exe
Resource
win11-20241007-en
General
-
Target
injection.exe
-
Size
623KB
-
MD5
927bfe05fe20529a0d2446b2b3fb326f
-
SHA1
e09cef72f5deeba0c2b54ab6f8532003df9cb2ba
-
SHA256
5cf0d331c890274f77c18eb8a90d911a50f452515371abbe47863413fac0838a
-
SHA512
f16679811b448df10542d881e6576fb2bc9fc8421e7b68ae1cdfd8ed7684c7eb7ac073dac63795da06c8bbb008fb2e01748e76f5aefed4ad90e08430bf46693e
-
SSDEEP
12288:eRRTKABlLm78h7d78LR3ArlQ5Ya2NA3X3uj:/ABI72d7ZlLa2S3X3m
Malware Config
Extracted
xworm
license-kings.gl.at.ply.gg:65464
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral3/memory/4584-122-0x000000001C360000-0x000000001C36E000-memory.dmp disable_win_def -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral3/files/0x001d00000002abca-48.dat family_xworm behavioral3/memory/4584-50-0x0000000000170000-0x00000000001B6000-memory.dmp family_xworm -
Njrat family
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3928 powershell.exe 540 powershell.exe 5048 powershell.exe 3556 powershell.exe 4632 powershell.exe 4736 powershell.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2668 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Executes dropped EXE 9 IoCs
pid Process 704 SearchApp.exe 4584 XClient.exe 1696 Server.exe 2212 1.exe 2924 XClient.exe 2304 XClient.exe 4384 XClient.exe 3692 XClient.exe 2536 XClient.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\cebbc17108ba69818fc4a0b0ed3bb871 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .." 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cebbc17108ba69818fc4a0b0ed3bb871 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .." 1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2556 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5048 powershell.exe 5048 powershell.exe 3556 powershell.exe 3556 powershell.exe 4632 powershell.exe 4632 powershell.exe 4736 powershell.exe 4736 powershell.exe 3928 powershell.exe 3928 powershell.exe 540 powershell.exe 540 powershell.exe 4584 XClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1288 injection.exe Token: SeBackupPrivilege 4612 vssvc.exe Token: SeRestorePrivilege 4612 vssvc.exe Token: SeAuditPrivilege 4612 vssvc.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 3556 powershell.exe Token: SeDebugPrivilege 704 SearchApp.exe Token: SeDebugPrivilege 704 SearchApp.exe Token: SeDebugPrivilege 4584 XClient.exe Token: SeDebugPrivilege 4632 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 540 powershell.exe Token: SeDebugPrivilege 4584 XClient.exe Token: SeDebugPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: SeDebugPrivilege 2924 XClient.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: SeDebugPrivilege 2304 XClient.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: SeDebugPrivilege 4384 XClient.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe Token: 33 2212 1.exe Token: SeIncBasePriorityPrivilege 2212 1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4584 XClient.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1288 wrote to memory of 5048 1288 injection.exe 81 PID 1288 wrote to memory of 5048 1288 injection.exe 81 PID 1288 wrote to memory of 3556 1288 injection.exe 83 PID 1288 wrote to memory of 3556 1288 injection.exe 83 PID 1288 wrote to memory of 3352 1288 injection.exe 86 PID 1288 wrote to memory of 3352 1288 injection.exe 86 PID 3352 wrote to memory of 2556 3352 cmd.exe 88 PID 3352 wrote to memory of 2556 3352 cmd.exe 88 PID 704 wrote to memory of 4584 704 SearchApp.exe 89 PID 704 wrote to memory of 4584 704 SearchApp.exe 89 PID 704 wrote to memory of 1696 704 SearchApp.exe 90 PID 704 wrote to memory of 1696 704 SearchApp.exe 90 PID 704 wrote to memory of 1696 704 SearchApp.exe 90 PID 4584 wrote to memory of 4632 4584 XClient.exe 91 PID 4584 wrote to memory of 4632 4584 XClient.exe 91 PID 4584 wrote to memory of 4736 4584 XClient.exe 93 PID 4584 wrote to memory of 4736 4584 XClient.exe 93 PID 4584 wrote to memory of 3928 4584 XClient.exe 95 PID 4584 wrote to memory of 3928 4584 XClient.exe 95 PID 4584 wrote to memory of 540 4584 XClient.exe 97 PID 4584 wrote to memory of 540 4584 XClient.exe 97 PID 4584 wrote to memory of 2344 4584 XClient.exe 99 PID 4584 wrote to memory of 2344 4584 XClient.exe 99 PID 1696 wrote to memory of 2212 1696 Server.exe 101 PID 1696 wrote to memory of 2212 1696 Server.exe 101 PID 1696 wrote to memory of 2212 1696 Server.exe 101 PID 2212 wrote to memory of 2668 2212 1.exe 102 PID 2212 wrote to memory of 2668 2212 1.exe 102 PID 2212 wrote to memory of 2668 2212 1.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\injection.exe"C:\Users\Admin\AppData\Local\Temp\injection.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2556
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
C:\Users\Admin\AppData\Roaming\SearchApp.exeC:\Users\Admin\AppData\Roaming\SearchApp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2344
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1.exe" "1.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
PID:3692
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
PID:2536
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52cbbb74b7da1f720b48ed31085cbd5b8
SHA179caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
944B
MD5f28832ecd9829ee81bb32f98f0747445
SHA1ac0dc6c286da7b0b7b1b595aaf4f8877e1304125
SHA256d44590cb55e999c1e0abdd9932e00ddde1bc637ac3eb7d02374ace88479f2f50
SHA5123b72129f951df7d4b2437ed761ff00ea9dc046a284665a3036b9c86fd20626435f775ec2bb9665435b7d8ec6a211e6c54d1debae75b5ae8778797b3485a163fa
-
Filesize
944B
MD50b59f3fa12628f63b5713c4833570d7f
SHA1badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb
SHA2562332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d
SHA51201724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7
-
Filesize
944B
MD5781da0576417bf414dc558e5a315e2be
SHA1215451c1e370be595f1c389f587efeaa93108b4c
SHA25641a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe
SHA51224e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737
-
Filesize
23KB
MD5617df0fff22badfb0a8a64fcaf37dd0a
SHA109eea43487d4b35eab31f391ade2914e8d197faf
SHA2565571bb2b05b74d957016264da9326046b1fa58e879506888ed554d1a287db8fb
SHA512e3d1b0e4bfb0cdfe2b1dd91e4b26893f7e26f37377f5ebc47faa43e7be33d1dc22bb431d0a1bcdf9776ffb3b470d5dbf983db77eea1ef5d584413ff7e76f6cbe
-
Filesize
256KB
MD5ac9c9db04b5ec03ff5af25507cb23af8
SHA1de562bb91f6eb99b4d82292c81b3d3f7b0ab59bb
SHA256dedf73abd94a48ff77f196baac62648f8bebbf9ce0ca4096922d50b3c7c19a9a
SHA512a81252c7c457727c5b5fef089d19225f504c0b53dfde96467c3cb349acfa16897790e4b55fa6ac7f0b9fc9aaed3d6caa5194b3ac2de5875c6aa3da94223a48b7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
161B
MD50e662b4adc4d6c2ac6e92d07b1595f82
SHA1dc6c0a05a5c26b192700787ffd311fd058269688
SHA25671ca7d0811d31f14b1abda119ebbbbfc6319fe138d580432f0472ef5487a961a
SHA51213513c6fa5612d5457fb0ce845baa5dcb5954da0fcdf407e4d79d7b5b0c3a60530fac3a3d995f228f7d8d72c447b71fe6fad12082154bb4c3ba8d71d9f894fa1
-
Filesize
623KB
MD5927bfe05fe20529a0d2446b2b3fb326f
SHA1e09cef72f5deeba0c2b54ab6f8532003df9cb2ba
SHA2565cf0d331c890274f77c18eb8a90d911a50f452515371abbe47863413fac0838a
SHA512f16679811b448df10542d881e6576fb2bc9fc8421e7b68ae1cdfd8ed7684c7eb7ac073dac63795da06c8bbb008fb2e01748e76f5aefed4ad90e08430bf46693e