Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 20:38 UTC
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20241007-en
General
-
Target
XClient.exe
-
Size
64KB
-
MD5
0b825a60d5232c19548fe6bee6eceaf7
-
SHA1
70b29e65c74ee6d11dd99ab644ea967efd868aa2
-
SHA256
ad13779dfed42b4f1fc882216a9157bc65aee15f058b784ea809b86fceae34af
-
SHA512
408f6f6239a4a11913f012d7a6ba8d7c48896312a894d574b892553aeb6658ad1f4599d1cc899beb2e762c6496654077dfbe253e0f4a53d63a5dd1327f1d570a
-
SSDEEP
1536:ElDBb5dZjeQ+3uYkkf9pWbkoxy061cOirS0LpHn2TfaS:Ell5/7+3uYkkXWbk+jOirS0dHEaS
Malware Config
Extracted
xworm
memory-lottery.gl.at.ply.gg:444
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/972-1-0x0000000000910000-0x0000000000926000-memory.dmp family_xworm behavioral2/files/0x000a000000023cbb-59.dat family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3420 powershell.exe 736 powershell.exe 3944 powershell.exe 4448 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk XClient.exe -
Executes dropped EXE 5 IoCs
pid Process 3080 security 2388 security 1356 security 4292 security 3172 security -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\security = "C:\\Users\\Admin\\AppData\\Roaming\\security" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4076 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 972 XClient.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3944 powershell.exe 3944 powershell.exe 4448 powershell.exe 4448 powershell.exe 3420 powershell.exe 3420 powershell.exe 736 powershell.exe 736 powershell.exe 972 XClient.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 972 XClient.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 3420 powershell.exe Token: SeDebugPrivilege 736 powershell.exe Token: SeDebugPrivilege 972 XClient.exe Token: SeDebugPrivilege 3080 security Token: SeDebugPrivilege 2388 security Token: SeDebugPrivilege 1356 security Token: SeDebugPrivilege 4292 security Token: SeDebugPrivilege 3172 security -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 972 XClient.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 972 wrote to memory of 3944 972 XClient.exe 82 PID 972 wrote to memory of 3944 972 XClient.exe 82 PID 972 wrote to memory of 4448 972 XClient.exe 84 PID 972 wrote to memory of 4448 972 XClient.exe 84 PID 972 wrote to memory of 3420 972 XClient.exe 86 PID 972 wrote to memory of 3420 972 XClient.exe 86 PID 972 wrote to memory of 736 972 XClient.exe 88 PID 972 wrote to memory of 736 972 XClient.exe 88 PID 972 wrote to memory of 4076 972 XClient.exe 92 PID 972 wrote to memory of 4076 972 XClient.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\security'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'security'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "security" /tr "C:\Users\Admin\AppData\Roaming\security"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4076
-
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172
Network
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requestmemory-lottery.gl.at.ply.ggIN AResponsememory-lottery.gl.at.ply.ggIN A147.185.221.25
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmemory-lottery.gl.at.ply.ggIN AResponsememory-lottery.gl.at.ply.ggIN A147.185.221.25
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
208 B 4
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
133.32.126.40.in-addr.arpa
-
146 B 139 B 2 1
DNS Request
167.173.78.104.in-addr.arpa
DNS Request
167.173.78.104.in-addr.arpa
-
73 B 89 B 1 1
DNS Request
memory-lottery.gl.at.ply.gg
DNS Response
147.185.221.25
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
22.49.80.91.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
73 B 89 B 1 1
DNS Request
memory-lottery.gl.at.ply.gg
DNS Response
147.185.221.25
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD52d06ce10e4e5b9e174b5ebbdad300fad
SHA1bcc1c231e22238cef02ae25331320060ada2f131
SHA25687d1dd56f12a88907ba5aebca8d555443d6f77ed214497277cc8bcd31c669f2c
SHA51238cfbeb59605854ae4fcfae8619a6b26bd916148acfb5636383672a3960b45ca41fed5c241f97465129e92eaf78c4c85dcf258f1ab501a2bf771287ce04f76a7
-
Filesize
944B
MD510890cda4b6eab618e926c4118ab0647
SHA11e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
SHA25600f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
SHA512a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
64KB
MD50b825a60d5232c19548fe6bee6eceaf7
SHA170b29e65c74ee6d11dd99ab644ea967efd868aa2
SHA256ad13779dfed42b4f1fc882216a9157bc65aee15f058b784ea809b86fceae34af
SHA512408f6f6239a4a11913f012d7a6ba8d7c48896312a894d574b892553aeb6658ad1f4599d1cc899beb2e762c6496654077dfbe253e0f4a53d63a5dd1327f1d570a