Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
Phantom.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Phantom.exe
Resource
win10v2004-20241007-en
General
-
Target
Phantom.exe
-
Size
1.5MB
-
MD5
c8eb9ad69f090d39291de91ff63171e0
-
SHA1
51826a1d888fc0cc994c7f2279bab39d80ef4f29
-
SHA256
4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d
-
SHA512
8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90
-
SSDEEP
24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b
Malware Config
Extracted
xworm
round-nonprofit.gl.at.ply.gg:40484
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016edc-17.dat family_xworm behavioral1/memory/2224-19-0x0000000001210000-0x0000000001226000-memory.dmp family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 2776 jizz's loader.exe 2708 Phantom.exe 2224 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phantom.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1192 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2988 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2224 svchost.exe Token: SeDebugPrivilege 2708 Phantom.exe Token: SeDebugPrivilege 2224 svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2776 2396 Phantom.exe 30 PID 2396 wrote to memory of 2776 2396 Phantom.exe 30 PID 2396 wrote to memory of 2776 2396 Phantom.exe 30 PID 2396 wrote to memory of 2708 2396 Phantom.exe 31 PID 2396 wrote to memory of 2708 2396 Phantom.exe 31 PID 2396 wrote to memory of 2708 2396 Phantom.exe 31 PID 2396 wrote to memory of 2708 2396 Phantom.exe 31 PID 2776 wrote to memory of 2224 2776 jizz's loader.exe 32 PID 2776 wrote to memory of 2224 2776 jizz's loader.exe 32 PID 2776 wrote to memory of 2224 2776 jizz's loader.exe 32 PID 2224 wrote to memory of 2988 2224 svchost.exe 33 PID 2224 wrote to memory of 2988 2224 svchost.exe 33 PID 2224 wrote to memory of 2988 2224 svchost.exe 33 PID 2224 wrote to memory of 1736 2224 svchost.exe 36 PID 2224 wrote to memory of 1736 2224 svchost.exe 36 PID 2224 wrote to memory of 1736 2224 svchost.exe 36 PID 2224 wrote to memory of 2300 2224 svchost.exe 38 PID 2224 wrote to memory of 2300 2224 svchost.exe 38 PID 2224 wrote to memory of 2300 2224 svchost.exe 38 PID 2300 wrote to memory of 1192 2300 cmd.exe 40 PID 2300 wrote to memory of 1192 2300 cmd.exe 40 PID 2300 wrote to memory of 1192 2300 cmd.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Phantom.exe"C:\Users\Admin\AppData\Local\Temp\Phantom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Roaming\jizz's loader.exe"C:\Users\Admin\AppData\Roaming\jizz's loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2988
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"4⤵PID:1736
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:1192
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Phantom.exe"C:\Users\Admin\AppData\Roaming\Phantom.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD511d0a684a5a37b74d1849ee24bed4e4d
SHA121ce5a96385e3b2d298b40e6313acd49dc2a94ea
SHA256973d30c27a145a09fbf252dff261ea35adb2f9fb9c176a03a4e9ea0e6566cb58
SHA51264476145942e603787c893f865c1c2173ccea99bd83b916db44387926c03abb58482744cf6b34875ac28800fddbe73a21b9e2a6b5610820ccb9b65d0a8c33aa6
-
Filesize
1.5MB
MD577447f97bedafe2dc903866ad18e25d6
SHA1aef3c31376a39c2fff32a5c0ee7807257e9f6108
SHA2562d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4
SHA5128cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475
-
Filesize
78KB
MD5c9dd066e7b21a78393bb547adbe4f38f
SHA1a3fc2a840eead4af2fc464911260453e4a14f994
SHA256fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b
SHA5129b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f
-
Filesize
62KB
MD5d18614c2a9514e8825b25963c5d51a60
SHA13cd489a3124342799f060f0360695d13cb82d97f
SHA25615cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed
SHA512f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12