Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 20:15

General

  • Target

    fixerformultitool.exe

  • Size

    79KB

  • MD5

    2f7fb28cf91e8ccb2257834f9136cfd6

  • SHA1

    b8f0f86c33bf46a8af745caf4bc0a8d5878e75f1

  • SHA256

    014f0079149caead324ea0d3adb18d65f607662b8725da7fec7628de4acf828f

  • SHA512

    4e0b8e0268346ddcd5c23d34c8c556eef66994d8c01f06bb5bd19cf1c25f00ee76ad8d0e1edb012ed64ba86a63cbcdb806595cc7d9dfc8ef4d31a4b6ef99c236

  • SSDEEP

    1536:KPlF7XxO2o6rx59bm1AXR8x8KG6GaOD2srtdn+6:KrXcID9bm1k9KHOD2sr/+6

Malware Config

Extracted

Family

xworm

C2

bad-motor.gl.at.ply.gg:4444

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe
    "C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fixerformultitool.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\security'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'security'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2300
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "security" /tr "C:\Users\Admin\AppData\Roaming\security"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2688
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {36AC1D62-6280-4E29-AEAA-CBD516BAD7EE} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Roaming\security
      C:\Users\Admin\AppData\Roaming\security
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3008
    • C:\Users\Admin\AppData\Roaming\security
      C:\Users\Admin\AppData\Roaming\security
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    4dff81d00779302dec27fe3a092ae946

    SHA1

    7974ff75f95a8d16cb68f816141885f7152ba9eb

    SHA256

    5bb297b1a60d29c85e7f2d7b29c24ac01db31fab379a9f9e162ed9cc33805035

    SHA512

    aad5bae8143caa0f8fd97013fcac8d0820efaf2223b14a4da759dd56619e766f4f0de3065b05bf9a1515e8b2758b6b6739eb570263b76146d6c0ba8e04e9692c

  • C:\Users\Admin\AppData\Roaming\security

    Filesize

    79KB

    MD5

    2f7fb28cf91e8ccb2257834f9136cfd6

    SHA1

    b8f0f86c33bf46a8af745caf4bc0a8d5878e75f1

    SHA256

    014f0079149caead324ea0d3adb18d65f607662b8725da7fec7628de4acf828f

    SHA512

    4e0b8e0268346ddcd5c23d34c8c556eef66994d8c01f06bb5bd19cf1c25f00ee76ad8d0e1edb012ed64ba86a63cbcdb806595cc7d9dfc8ef4d31a4b6ef99c236

  • memory/2252-1-0x0000000000D40000-0x0000000000D5A000-memory.dmp

    Filesize

    104KB

  • memory/2252-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

    Filesize

    4KB

  • memory/2252-32-0x000000001ACC0000-0x000000001AD40000-memory.dmp

    Filesize

    512KB

  • memory/2252-31-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

    Filesize

    4KB

  • memory/2252-30-0x000000001ACC0000-0x000000001AD40000-memory.dmp

    Filesize

    512KB

  • memory/2372-7-0x000000001B650000-0x000000001B932000-memory.dmp

    Filesize

    2.9MB

  • memory/2372-8-0x00000000021D0000-0x00000000021D8000-memory.dmp

    Filesize

    32KB

  • memory/2372-6-0x0000000002210000-0x0000000002290000-memory.dmp

    Filesize

    512KB

  • memory/2708-15-0x0000000002860000-0x0000000002868000-memory.dmp

    Filesize

    32KB

  • memory/2708-14-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

    Filesize

    2.9MB

  • memory/3008-36-0x00000000013E0000-0x00000000013FA000-memory.dmp

    Filesize

    104KB