Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/01/2025, 01:03

250113-bevx8a1jcj 10

12/01/2025, 12:50

250112-p22wyavqbn 10

10/01/2025, 13:35

250110-qvvdysvqev 10

Analysis

  • max time kernel
    92s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/01/2025, 13:35

Errors

Reason
Machine shutdown

General

  • Target

    XWorm.V7.2.zip

  • Size

    34.5MB

  • MD5

    9a678aadc9ed2e2bd69c4c3de72f9e69

  • SHA1

    742de1cae6423b50f59a9c757b016314f492f455

  • SHA256

    8a615f3ae908bbbfd33c6c019db5791372fd0bddae07681816ea43d12dd73bd9

  • SHA512

    8eb793302fa16fd155c465271288275e929cd4a63017b48925b57d73dfca889f7b36273aabbc3a08264a4eb6ea95899f61afe7a430c362d7cf22145787a70bd4

  • SSDEEP

    786432:2Aei7Z9K1koiZEj6mcaFf8G465XEDgjHOED+K6gWvPgbHGGg:eqSiFhuUJkhjHPOgbHG/

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

WcpxqjjxSrB6UOUw

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/RPPi3ByL

  • telegram

    https://api.telegram.org/bot7483240807:AAHWuUBi6sW9ZOb0kfXVbzbMVyLtPj-9vZY/sendMessage?chat_id=5279018187

aes.plain
aes.plain
aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

51.89.44.68:8848

Mutex

etb3t1tr5n

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Detect Xworm Payload 6 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Async RAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Drops startup file 6 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.V7.2.zip"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\7zO0B77A498\XWorm V7.2.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO0B77A498\XWorm V7.2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
        "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:660
      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1648
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4216
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4436
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2336
      • C:\Users\Admin\AppData\Local\Temp\msedge.exe
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4720
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2032
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2036
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2268
      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        3⤵
        • Executes dropped EXE
        PID:1316
      • C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe
        "C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3204
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    781da0576417bf414dc558e5a315e2be

    SHA1

    215451c1e370be595f1c389f587efeaa93108b4c

    SHA256

    41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

    SHA512

    24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    e8a7ab7bae6a69946da69507ee7ae7b0

    SHA1

    b367c72fa4948493819e1c32c32239aa6e78c252

    SHA256

    cd5480d72c1a359e83f7d6b6d7d21e1be2463f2c6718385cc6c393c88323b272

    SHA512

    89b22519bc3986be52801397e6eff4550621b4804abd2d04f431c9b2591ba8e3eab2625490a56ebb947ba3b122b6186badb6c461e917b69d7e13644c86a6f683

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    5b705b4839f481b2485f2195c589cad0

    SHA1

    a55866cd9e6fedf352d0e937101755ea61a50c86

    SHA256

    f6a3b94a63de605bbbcf1e95cb2d743166f44ea7e9d0d2bfa0e88c94c26e37c6

    SHA512

    f228eccd5646068a81e79baeaf7e8bfa470b30d503bf0ca8cc746c009510ab609b5c091cadf08fab1e3581900cdb7834c775c61a95a29c2d73ccd0dcbd851bab

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    e3840d9bcedfe7017e49ee5d05bd1c46

    SHA1

    272620fb2605bd196df471d62db4b2d280a363c6

    SHA256

    3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

    SHA512

    76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

  • C:\Users\Admin\AppData\Local\Temp\7zO0B77A498\XWorm V7.2.exe

    Filesize

    21.6MB

    MD5

    ba23d65ef70b05cd3b04dfcbbd801059

    SHA1

    5c241dc3d79f61bdf82d091bfe29bca2e641d802

    SHA256

    0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d

    SHA512

    d32a4838ca544b9b4764bb99b716faf797aa194199151426a8848c1ed27b5f2428629324d30f15db138ff56d34d46233e3ef106ad416eff29de43eb8ade0eff9

  • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe

    Filesize

    153KB

    MD5

    8b8585c779df2f6df99f749d3b07f146

    SHA1

    b553267f8e6f2bb6531ca2cb330e0d6b7bc41a1d

    SHA256

    4a9d13e9b68d26c6feb71856b7a61a2a1b8f2dc1c7aaa9ad5dfd5609b5a2da6c

    SHA512

    b89cae4386d0b8173b87533b5af3d863a188836185d105d6007786ba0e415537e84b759b8c22b37430ee544c554db9f50aa21466c5549c8b80c4f5a3fa6cb5c7

  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

    Filesize

    140KB

    MD5

    a1cd6f4a3a37ed83515aa4752f98eb1d

    SHA1

    7f787c8d72787d8d130b4788b006b799167d1802

    SHA256

    5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

    SHA512

    9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe

    Filesize

    14.9MB

    MD5

    56ccb739926a725e78a7acf9af52c4bb

    SHA1

    5b01b90137871c3c8f0d04f510c4d56b23932cbc

    SHA256

    90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

    SHA512

    2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rokc0niu.bnd.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\msedge.exe

    Filesize

    166KB

    MD5

    aee20d80f94ae0885bb2cabadb78efc9

    SHA1

    1e82eba032fcb0b89e1fdf937a79133a5057d0a1

    SHA256

    498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

    SHA512

    3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

  • C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe

    Filesize

    6.1MB

    MD5

    b3899dd5602b3587ee487ba34d7cfd47

    SHA1

    ace70e4fcea9b819eaf5bda4453866698252357f

    SHA256

    28c53ad86d705da7e21a1c0cbc996e15ab8f024368aa031b025d05f3dfdbeb2e

    SHA512

    104b8252db4e9a88e388370a6def71e0cbb536604d5a41ac60169a35a9662980d1359000d5ea316f29deb4c534678e86e266bba12bb0b658f2666d13b26c200a

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    63KB

    MD5

    67ca41c73d556cc4cfc67fc5b425bbbd

    SHA1

    ada7f812cd581c493630eca83bf38c0f8b32b186

    SHA256

    23d2e491a8c7f2f7f344764e6879d9566c9a3e55a3788038e48b346c068dde5b

    SHA512

    0dceb6468147cd2497adf31843389a78460ed5abe2c5a13488fc55a2d202ee6ce0271821d3cf12bc1f09a4d6b79a737ea3bccfc2bb87f89b3fff6410fa85ec02

  • memory/1316-69-0x000001BCB5840000-0x000001BCB6728000-memory.dmp

    Filesize

    14.9MB

  • memory/1548-49-0x0000000000E30000-0x0000000000E58000-memory.dmp

    Filesize

    160KB

  • memory/1564-13-0x0000000000510000-0x0000000001AA4000-memory.dmp

    Filesize

    21.6MB

  • memory/1564-12-0x00007FFFEE623000-0x00007FFFEE625000-memory.dmp

    Filesize

    8KB

  • memory/1648-88-0x000001A349300000-0x000001A349322000-memory.dmp

    Filesize

    136KB

  • memory/1972-33-0x0000000000660000-0x000000000068C000-memory.dmp

    Filesize

    176KB

  • memory/3204-128-0x0000000000A50000-0x0000000000A66000-memory.dmp

    Filesize

    88KB

  • memory/3868-48-0x0000000000E20000-0x0000000000E4E000-memory.dmp

    Filesize

    184KB

  • memory/4324-74-0x000001ED44470000-0x000001ED44A86000-memory.dmp

    Filesize

    6.1MB

  • memory/4324-209-0x000001ED5F600000-0x000001ED5F6B2000-memory.dmp

    Filesize

    712KB