Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 21:56
Behavioral task
behavioral1
Sample
adsav.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
adsav.exe
-
Size
55KB
-
MD5
80c7ba2da4987600d1e9008265aafb0d
-
SHA1
4712783a6004912fd4cedd71e9f60a0ddd03b6d0
-
SHA256
47d0ceb844938cc8c28168f069f45461e5f0d670205fef7d092a41704ae416f0
-
SHA512
fbefdc6b3f2d6669c1382ebad364d96e9561c40d561e6d9d9a1d50e331d54c72d7fd3602f8f9e2824a43ee11e20bd0d15f2dc80fef27fe840618c0b2c6c31317
-
SSDEEP
768:h2GgkY5J4Z3LSPQVrHO46v/qNo/ORG7CAXORF72pC+beeM2cSj428lDADOcLeh+E:hLEv/6om47OR92k+bVRcSESO7gJXG
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:58981
147.185.221.24:58981
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/2132-1-0x00000000005E0000-0x00000000005F4000-memory.dmp family_xworm behavioral1/files/0x0008000000023cc9-26.dat family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk adsav.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk adsav.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" adsav.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 2132 adsav.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2132 adsav.exe Token: SeDebugPrivilege 2132 adsav.exe Token: SeDebugPrivilege 4840 taskmgr.exe Token: SeSystemProfilePrivilege 4840 taskmgr.exe Token: SeCreateGlobalPrivilege 4840 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2132 adsav.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adsav.exe"C:\Users\Admin\AppData\Local\Temp\adsav.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2132
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766B
MD53cc90689c22580094ea3e427fa8c91f3
SHA1f3146d5faa3da58eaf223a48b3303653327b17d6
SHA2569dc6e77c03c353b0b5ea375d6396fb718101988d75cde34ca0e5cf43667e7bdd
SHA512c6ae11f77b112eb9839d682e726f230161a4b2f92d68661e2e2586fd114d77cf93c75600385c1a070b5f594e9d0ec1bf55360be96f0b22d9e1f42dea68e7a451
-
Filesize
55KB
MD580c7ba2da4987600d1e9008265aafb0d
SHA14712783a6004912fd4cedd71e9f60a0ddd03b6d0
SHA25647d0ceb844938cc8c28168f069f45461e5f0d670205fef7d092a41704ae416f0
SHA512fbefdc6b3f2d6669c1382ebad364d96e9561c40d561e6d9d9a1d50e331d54c72d7fd3602f8f9e2824a43ee11e20bd0d15f2dc80fef27fe840618c0b2c6c31317