Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 09:47 UTC
General
-
Target
21012025_0947_21012025_cotización.exe
-
Size
68KB
-
MD5
88d8158ca98088d881cd08846dca5f24
-
SHA1
1c11b75aac23b72b29a47bff55106ef8ac04bf47
-
SHA256
6d217281437ec6542d839a5f130e001c3df8aa9b20d47f48927600e10b4862d7
-
SHA512
8cdbaafb8c90fe1e7d3018036ac53048fab1f84f7503cac91d610b4b383c58942d2e1ded25d68d60b73657fc270798017e512898a5d04d76c51a7ee7afd78843
-
SSDEEP
768:+sX7zPeSAnG9cdeWOkglgS2x3M9hfVR431QWyVsFfY3CF2zInyQS+ST6nkC1:fvPeHn1ebeS59ql6sFQ3giInv/mq
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
194.59.31.174:5151
Mutex
4qOnj8VqoV2MS71I
Attributes
-
install_file
USB.exe
aes.plain
1
d4/p3TepfrOKi0MBbXUuRA==
Signatures
-
Detect Xworm Payload 1 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\21012025_0947_21012025_cotización.exe"C:\Users\Admin\AppData\Local\Temp\21012025_0947_21012025_cotización.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
-
DNSoshi.atRemote address:8.8.8.8:53Requestoshi.atIN AResponseoshi.atIN A194.15.112.248 -
GEThttps://oshi.at/fcXkRemote address:194.15.112.248:443RequestGET /fcXk HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Host: oshi.at
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Server: nginx
Date: Tue, 21 Jan 2025 09:47:44 GMT
Content-Type: video/mp4
Content-Length: 1027592
Connection: keep-alive
Accept-Ranges: bytes
Last-Modified: Mon, 20 Jan 2025 16:11:04 GMT
ETag: "7934cc6ee5eaf3acb5a0ce58fa9fad77"
Content-Disposition: attachment; filename=EcKp.mp4
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
DNS75.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTRResponse
-
DNS248.112.15.194.in-addr.arpaRemote address:8.8.8.8:53Request248.112.15.194.in-addr.arpaIN PTRResponse
-
DNS167.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS174.31.59.194.in-addr.arpaRemote address:8.8.8.8:53Request174.31.59.194.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS167.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request167.190.18.2.in-addr.arpaIN PTRResponse167.190.18.2.in-addr.arpaIN PTRa2-18-190-167deploystaticakamaitechnologiescom
-
DNS60.153.16.2.in-addr.arpaRemote address:8.8.8.8:53Request60.153.16.2.in-addr.arpaIN PTRResponse60.153.16.2.in-addr.arpaIN PTRa2-16-153-60deploystaticakamaitechnologiescom
-
DNS181.129.81.91.in-addr.arpaRemote address:8.8.8.8:53Request181.129.81.91.in-addr.arpaIN PTRResponse
-
194.15.112.248:443https://oshi.at/fcXktls, http
HTTP Request
GET https://oshi.at/fcXkHTTP Response
200 -
194.59.31.174:5151
-
8.8.8.8:53oshi.atdns
DNS Request
oshi.at
DNS Response
194.15.112.248
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:5375.159.190.20.in-addr.arpadns
DNS Request
75.159.190.20.in-addr.arpa
-
8.8.8.8:53248.112.15.194.in-addr.arpadns
DNS Request
248.112.15.194.in-addr.arpa
-
8.8.8.8:53167.173.78.104.in-addr.arpadns
DNS Request
167.173.78.104.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53174.31.59.194.in-addr.arpadns
DNS Request
174.31.59.194.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:53167.190.18.2.in-addr.arpadns
DNS Request
167.190.18.2.in-addr.arpa
-
8.8.8.8:5360.153.16.2.in-addr.arpadns
DNS Request
60.153.16.2.in-addr.arpa
-
8.8.8.8:53181.129.81.91.in-addr.arpadns
DNS Request
181.129.81.91.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
7.7MB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1.0MB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
7.7MB
-
Filesize
352KB
-
Filesize
304KB
-
Filesize
368KB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB