Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 06:38

General

  • Target

    Phantom.exe

  • Size

    1.5MB

  • MD5

    c8eb9ad69f090d39291de91ff63171e0

  • SHA1

    51826a1d888fc0cc994c7f2279bab39d80ef4f29

  • SHA256

    4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d

  • SHA512

    8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90

  • SSDEEP

    24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b

Malware Config

Extracted

Family

xworm

C2

round-nonprofit.gl.at.ply.gg:40484

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Phantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Phantom.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Users\Admin\AppData\Roaming\jizz's loader.exe
      "C:\Users\Admin\AppData\Roaming\jizz's loader.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3316
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
          4⤵
            PID:4540
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF8B.tmp.bat""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3568
            • C:\Windows\system32\timeout.exe
              timeout 3
              5⤵
              • Delays execution with timeout.exe
              PID:2032
      • C:\Users\Admin\AppData\Roaming\Phantom.exe
        "C:\Users\Admin\AppData\Roaming\Phantom.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2196

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF8B.tmp.bat

      Filesize

      155B

      MD5

      fa07f1efe6ce6456d1693668464d48d0

      SHA1

      16b742116659a6097ff7439454fc7cc6db24b110

      SHA256

      8ed405ea1e57734cfa2a80a160f9c2e5ca260f5d86743333507c66579b4ff048

      SHA512

      e35427c60646ebf9c3a6818e5e6e0de107d93f185d6ac074ee24d2adb5cf9c7cce00e23105ec79e849a793a7560df180276ad03fe5164d966cf1418f98a2bab4

    • C:\Users\Admin\AppData\Roaming\Phantom.exe

      Filesize

      1.5MB

      MD5

      77447f97bedafe2dc903866ad18e25d6

      SHA1

      aef3c31376a39c2fff32a5c0ee7807257e9f6108

      SHA256

      2d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4

      SHA512

      8cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475

    • C:\Users\Admin\AppData\Roaming\jizz's loader.exe

      Filesize

      78KB

      MD5

      c9dd066e7b21a78393bb547adbe4f38f

      SHA1

      a3fc2a840eead4af2fc464911260453e4a14f994

      SHA256

      fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b

      SHA512

      9b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      62KB

      MD5

      d18614c2a9514e8825b25963c5d51a60

      SHA1

      3cd489a3124342799f060f0360695d13cb82d97f

      SHA256

      15cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed

      SHA512

      f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12

    • memory/2196-40-0x0000000000A80000-0x0000000000BFA000-memory.dmp

      Filesize

      1.5MB

    • memory/2196-42-0x0000000005CA0000-0x0000000006244000-memory.dmp

      Filesize

      5.6MB

    • memory/2196-43-0x0000000005490000-0x0000000005522000-memory.dmp

      Filesize

      584KB

    • memory/2196-44-0x0000000005650000-0x000000000565A000-memory.dmp

      Filesize

      40KB

    • memory/2196-45-0x0000000006760000-0x0000000006810000-memory.dmp

      Filesize

      704KB

    • memory/4048-0-0x00007FFA484F3000-0x00007FFA484F5000-memory.dmp

      Filesize

      8KB

    • memory/4048-1-0x0000000000840000-0x00000000009D2000-memory.dmp

      Filesize

      1.6MB

    • memory/4124-23-0x0000000000200000-0x000000000021A000-memory.dmp

      Filesize

      104KB

    • memory/4124-27-0x00007FFA484F0000-0x00007FFA48FB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4124-41-0x00007FFA484F0000-0x00007FFA48FB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4836-39-0x0000000000170000-0x0000000000186000-memory.dmp

      Filesize

      88KB