Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
Phantom.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Phantom.exe
Resource
win10v2004-20241007-en
General
-
Target
Phantom.exe
-
Size
1.5MB
-
MD5
c8eb9ad69f090d39291de91ff63171e0
-
SHA1
51826a1d888fc0cc994c7f2279bab39d80ef4f29
-
SHA256
4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d
-
SHA512
8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90
-
SSDEEP
24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b
Malware Config
Extracted
xworm
round-nonprofit.gl.at.ply.gg:40484
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023c67-36.dat family_xworm behavioral2/memory/4836-39-0x0000000000170000-0x0000000000186000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation jizz's loader.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Phantom.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 4124 jizz's loader.exe 2196 Phantom.exe 4836 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 13 raw.githubusercontent.com 12 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phantom.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2032 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3316 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4836 svchost.exe Token: SeDebugPrivilege 2196 Phantom.exe Token: SeDebugPrivilege 4836 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4048 wrote to memory of 4124 4048 Phantom.exe 83 PID 4048 wrote to memory of 4124 4048 Phantom.exe 83 PID 4048 wrote to memory of 2196 4048 Phantom.exe 84 PID 4048 wrote to memory of 2196 4048 Phantom.exe 84 PID 4048 wrote to memory of 2196 4048 Phantom.exe 84 PID 4124 wrote to memory of 4836 4124 jizz's loader.exe 85 PID 4124 wrote to memory of 4836 4124 jizz's loader.exe 85 PID 4836 wrote to memory of 3316 4836 svchost.exe 87 PID 4836 wrote to memory of 3316 4836 svchost.exe 87 PID 4836 wrote to memory of 4540 4836 svchost.exe 102 PID 4836 wrote to memory of 4540 4836 svchost.exe 102 PID 4836 wrote to memory of 3568 4836 svchost.exe 104 PID 4836 wrote to memory of 3568 4836 svchost.exe 104 PID 3568 wrote to memory of 2032 3568 cmd.exe 106 PID 3568 wrote to memory of 2032 3568 cmd.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Phantom.exe"C:\Users\Admin\AppData\Local\Temp\Phantom.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Roaming\jizz's loader.exe"C:\Users\Admin\AppData\Roaming\jizz's loader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:3316
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"4⤵PID:4540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF8B.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:2032
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Phantom.exe"C:\Users\Admin\AppData\Roaming\Phantom.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD5fa07f1efe6ce6456d1693668464d48d0
SHA116b742116659a6097ff7439454fc7cc6db24b110
SHA2568ed405ea1e57734cfa2a80a160f9c2e5ca260f5d86743333507c66579b4ff048
SHA512e35427c60646ebf9c3a6818e5e6e0de107d93f185d6ac074ee24d2adb5cf9c7cce00e23105ec79e849a793a7560df180276ad03fe5164d966cf1418f98a2bab4
-
Filesize
1.5MB
MD577447f97bedafe2dc903866ad18e25d6
SHA1aef3c31376a39c2fff32a5c0ee7807257e9f6108
SHA2562d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4
SHA5128cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475
-
Filesize
78KB
MD5c9dd066e7b21a78393bb547adbe4f38f
SHA1a3fc2a840eead4af2fc464911260453e4a14f994
SHA256fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b
SHA5129b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f
-
Filesize
62KB
MD5d18614c2a9514e8825b25963c5d51a60
SHA13cd489a3124342799f060f0360695d13cb82d97f
SHA25615cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed
SHA512f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12