Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 13:46

General

  • Target

    2024-01-10-18-19-14.exe

  • Size

    74KB

  • MD5

    2536196d167ace8223ae7453964efc43

  • SHA1

    56299f1745c8ec79d0208b14d10eb744d927b70e

  • SHA256

    f9cd798df715647337e56cedf49fcf778ed456d82f4a39114830e6de52568696

  • SHA512

    625b771cdda5f60569657c6c347dc22deda3cc545f783f212a6a48a6d4c013d65e18b67ec8124e6e58fe84f80d511a4ce29bc657d94911b13e30fbc86da6aa5c

  • SSDEEP

    1536:l09hsM7RYzLo4DsZSICu4My9mGm51dU0tppsOuVggs0Rh69:lCD7RcjDs0ICuesGodXXM3R

Malware Config

Extracted

Family

xworm

C2

trip-thesaurus.gl.at.ply.gg:16715

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAaAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAaAB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAaABqACMAPgA="
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Windows\2024-01-10-18-19-14.exe
      "C:\Windows\2024-01-10-18-19-14.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\2024-01-10-18-19-14.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2024-01-10-18-19-14.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1704
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3728
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4148
      • C:\Windows\SYSTEM32\CMD.EXE
        "CMD.EXE"
        3⤵
          PID:4180
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4068
          • C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"
            4⤵
            • Checks computer location settings
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1500
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAaAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAaAB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAaABqACMAPgA="
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3524
            • C:\Windows\2024-01-10-18-19-14.exe
              "C:\Windows\2024-01-10-18-19-14.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3568
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2924
    • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      C:\Users\Admin\AppData\Roaming\SecurityHealthSystray
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecurityHealthSystray.log

      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      9b80cd7a712469a4c45fec564313d9eb

      SHA1

      6125c01bc10d204ca36ad1110afe714678655f2d

      SHA256

      5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

      SHA512

      ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      eb1ad317bd25b55b2bbdce8a28a74a94

      SHA1

      98a3978be4d10d62e7411946474579ee5bdc5ea6

      SHA256

      9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

      SHA512

      d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      d28a889fd956d5cb3accfbaf1143eb6f

      SHA1

      157ba54b365341f8ff06707d996b3635da8446f7

      SHA256

      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

      SHA512

      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      070dbd3d163d4be78a79266b7dfe091f

      SHA1

      667e8d8f0a6744f04a4d230d4e7b9838c2c35bb2

      SHA256

      2e929eb1246dd09fb3deef36e3d3c4241f6139160b4974acbb34f1d6216e0e65

      SHA512

      8966bda3e87d2ef763c8dad55af809df84de1ecc1530fb6989bd05f02563d40f53f1e88ceb5998cd70812787b77c50c58d6dc07857a8f8a623a543c3d7a718e4

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ilc0sei.5x4.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk

      Filesize

      819B

      MD5

      9c0b3412fe75b2506c59f0a950363da1

      SHA1

      44f9dd56d69223387809007c71f194263f7e0168

      SHA256

      07def7d902fe9d8a46bcc3bf804a7610c57f3fd7de573e599da1e018f07f3a3c

      SHA512

      b75f844e0cdd139c52f5a29ecd883d3b9f7b250fd00248544ff6536c78c7f3e36a34ff1942ca0096206afc37a1e558f4285061677e9d44b53f5efd394f56cb62

    • C:\Windows\2024-01-10-18-19-14.exe

      Filesize

      68KB

      MD5

      0c8294e9d43eab4f86105d4c92afbfa0

      SHA1

      338416be49b72459690d9bc8e5d0da66dae8ffd5

      SHA256

      55b9e348d510dcaeb9ac6d33eb7d4057cbfe186feb3ce476eb26935db1fd393d

      SHA512

      f24cd690851ce0a2dff4c009ebc87d8072c6ad76cfaa5ff16fa318af87887fbc623fdfe26b141b4c1c7ab8f911bbae503b7514fb8ef5229f5579b5a5106be491

    • memory/1624-64-0x0000025158500000-0x0000025158522000-memory.dmp

      Filesize

      136KB

    • memory/2300-132-0x000000001E530000-0x000000001E5E0000-memory.dmp

      Filesize

      704KB

    • memory/2300-51-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

      Filesize

      64KB

    • memory/2300-125-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

      Filesize

      64KB

    • memory/2300-129-0x000000001C470000-0x000000001C47A000-memory.dmp

      Filesize

      40KB

    • memory/2300-11-0x00007FFF166E3000-0x00007FFF166E5000-memory.dmp

      Filesize

      8KB

    • memory/2300-133-0x000000001ED10000-0x000000001F238000-memory.dmp

      Filesize

      5.2MB

    • memory/2300-12-0x00000000007D0000-0x00000000007E8000-memory.dmp

      Filesize

      96KB

    • memory/2588-54-0x00000000078D0000-0x00000000078E1000-memory.dmp

      Filesize

      68KB

    • memory/2588-30-0x0000000005DC0000-0x0000000006114000-memory.dmp

      Filesize

      3.3MB

    • memory/2588-47-0x0000000007610000-0x00000000076B3000-memory.dmp

      Filesize

      652KB

    • memory/2588-48-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-49-0x0000000007D40000-0x00000000083BA000-memory.dmp

      Filesize

      6.5MB

    • memory/2588-50-0x00000000076C0000-0x00000000076DA000-memory.dmp

      Filesize

      104KB

    • memory/2588-45-0x0000000006980000-0x000000000699E000-memory.dmp

      Filesize

      120KB

    • memory/2588-52-0x0000000007740000-0x000000000774A000-memory.dmp

      Filesize

      40KB

    • memory/2588-53-0x0000000007960000-0x00000000079F6000-memory.dmp

      Filesize

      600KB

    • memory/2588-34-0x0000000070F20000-0x0000000070F6C000-memory.dmp

      Filesize

      304KB

    • memory/2588-35-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-67-0x0000000007910000-0x000000000791E000-memory.dmp

      Filesize

      56KB

    • memory/2588-68-0x0000000007920000-0x0000000007934000-memory.dmp

      Filesize

      80KB

    • memory/2588-33-0x0000000006940000-0x0000000006972000-memory.dmp

      Filesize

      200KB

    • memory/2588-79-0x0000000007A00000-0x0000000007A1A000-memory.dmp

      Filesize

      104KB

    • memory/2588-32-0x00000000063C0000-0x000000000640C000-memory.dmp

      Filesize

      304KB

    • memory/2588-81-0x0000000007950000-0x0000000007958000-memory.dmp

      Filesize

      32KB

    • memory/2588-31-0x0000000006380000-0x000000000639E000-memory.dmp

      Filesize

      120KB

    • memory/2588-95-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-46-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-13-0x000000007510E000-0x000000007510F000-memory.dmp

      Filesize

      4KB

    • memory/2588-14-0x0000000002DF0000-0x0000000002E26000-memory.dmp

      Filesize

      216KB

    • memory/2588-16-0x0000000005480000-0x0000000005AA8000-memory.dmp

      Filesize

      6.2MB

    • memory/2588-15-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-18-0x00000000053E0000-0x0000000005402000-memory.dmp

      Filesize

      136KB

    • memory/2588-17-0x0000000075100000-0x00000000758B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2588-20-0x0000000005D50000-0x0000000005DB6000-memory.dmp

      Filesize

      408KB

    • memory/2588-19-0x0000000005CE0000-0x0000000005D46000-memory.dmp

      Filesize

      408KB

    • memory/2924-119-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-118-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-120-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-121-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-122-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-123-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-124-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-114-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-113-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/2924-112-0x0000021521640000-0x0000021521641000-memory.dmp

      Filesize

      4KB

    • memory/3524-149-0x0000000005C00000-0x0000000005F54000-memory.dmp

      Filesize

      3.3MB

    • memory/3524-151-0x0000000070F20000-0x0000000070F6C000-memory.dmp

      Filesize

      304KB