Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 06:38

General

  • Target

    Phantom.exe

  • Size

    1.5MB

  • MD5

    c8eb9ad69f090d39291de91ff63171e0

  • SHA1

    51826a1d888fc0cc994c7f2279bab39d80ef4f29

  • SHA256

    4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d

  • SHA512

    8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90

  • SSDEEP

    24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b

Malware Config

Extracted

Family

xworm

C2

round-nonprofit.gl.at.ply.gg:40484

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Phantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Phantom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Roaming\jizz's loader.exe
      "C:\Users\Admin\AppData\Roaming\jizz's loader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2988
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
          4⤵
            PID:1736
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp.bat""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2300
            • C:\Windows\system32\timeout.exe
              timeout 3
              5⤵
              • Delays execution with timeout.exe
              PID:1192
      • C:\Users\Admin\AppData\Roaming\Phantom.exe
        "C:\Users\Admin\AppData\Roaming\Phantom.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp.bat

      Filesize

      156B

      MD5

      11d0a684a5a37b74d1849ee24bed4e4d

      SHA1

      21ce5a96385e3b2d298b40e6313acd49dc2a94ea

      SHA256

      973d30c27a145a09fbf252dff261ea35adb2f9fb9c176a03a4e9ea0e6566cb58

      SHA512

      64476145942e603787c893f865c1c2173ccea99bd83b916db44387926c03abb58482744cf6b34875ac28800fddbe73a21b9e2a6b5610820ccb9b65d0a8c33aa6

    • C:\Users\Admin\AppData\Roaming\Phantom.exe

      Filesize

      1.5MB

      MD5

      77447f97bedafe2dc903866ad18e25d6

      SHA1

      aef3c31376a39c2fff32a5c0ee7807257e9f6108

      SHA256

      2d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4

      SHA512

      8cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475

    • C:\Users\Admin\AppData\Roaming\jizz's loader.exe

      Filesize

      78KB

      MD5

      c9dd066e7b21a78393bb547adbe4f38f

      SHA1

      a3fc2a840eead4af2fc464911260453e4a14f994

      SHA256

      fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b

      SHA512

      9b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      62KB

      MD5

      d18614c2a9514e8825b25963c5d51a60

      SHA1

      3cd489a3124342799f060f0360695d13cb82d97f

      SHA256

      15cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed

      SHA512

      f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12

    • memory/2224-19-0x0000000001210000-0x0000000001226000-memory.dmp

      Filesize

      88KB

    • memory/2396-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

      Filesize

      4KB

    • memory/2396-1-0x0000000000B20000-0x0000000000CB2000-memory.dmp

      Filesize

      1.6MB

    • memory/2708-20-0x0000000001190000-0x000000000130A000-memory.dmp

      Filesize

      1.5MB

    • memory/2708-22-0x0000000005F10000-0x0000000005FC0000-memory.dmp

      Filesize

      704KB

    • memory/2776-13-0x0000000000010000-0x000000000002A000-memory.dmp

      Filesize

      104KB

    • memory/2776-21-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB