Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 09:11

General

  • Target

    SPOOFER TREY.exe

  • Size

    76KB

  • MD5

    fff2d0ea19905c9a8f6c6fca38f64b15

  • SHA1

    deb5dec4ca7de9ba0795f441ccda2683317341a9

  • SHA256

    8fd825863687566693df92add60bc259abe5436238e8b99369fad09b17aa5aaf

  • SHA512

    aa8f6e5cb2e2fdc505ffa67246bd5539d853c2a22221911a7f2bb84749d11b10a29fbf7fb9d5244a84d082c5f387a5861c34b71e96f57b720a34c6216d8f1558

  • SSDEEP

    1536:ho2cR9MCrmWPDjC0hIgQLCap5BzGd0B/JUT4l7A9EkNof:2hCuF7aftGO3Tc+f

Malware Config

Extracted

Family

xworm

C2

exchange-syndicate.gl.at.ply.gg:22530

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SPOOFER TREY.exe
    "C:\Users\Admin\AppData\Local\Temp\SPOOFER TREY.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SYSTEM';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SYSTEM' -Value '"C:\Users\Admin\AppData\Roaming\spoofer\spoofer.exe"' -PropertyType 'String'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2464
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3272
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    def65711d78669d7f8e69313be4acf2e

    SHA1

    6522ebf1de09eeb981e270bd95114bc69a49cda6

    SHA256

    aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

    SHA512

    05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    1ed2e4f1927c9f6c7c19c0ad48b91bf2

    SHA1

    0bbac5be7fc7aacf5694722a29d1f3aa3460cb04

    SHA256

    5da2a38f8c39204570545a8ff16c68a8ee7cfd28511a7b7383f6542375a7fe61

    SHA512

    e5c918f488596dfb133fb5a6f6584fdb82decd35922c1b9167577b82986f46fa99e76ae9301accd796e25a55b863b7a73e0e17626132eb5717fa3d3fc540e00b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    b8830b50b126939794b79fc7ce9216a0

    SHA1

    77a7b9fbcba7d54a6e135d354be1700f88406c37

    SHA256

    bd9be4b914ef5ef653190e18c3dd9b6e2c1e201284365b4191b225db269f08a9

    SHA512

    6dc5ed95da5f70dd6ec74fa697622f48159d6e3cdbf6bbc6ff471ebb2ef2ab0a7296cc9c491386b79b81c6c318aac3ce57b0aeee6c204c46dd711264c29ec4b9

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slcwgtx0.35o.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1892-87-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

    Filesize

    304KB

  • memory/2464-34-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

    Filesize

    120KB

  • memory/2464-21-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

    Filesize

    136KB

  • memory/2464-37-0x00000000060D0000-0x00000000060EA000-memory.dmp

    Filesize

    104KB

  • memory/2464-36-0x0000000006150000-0x00000000061E6000-memory.dmp

    Filesize

    600KB

  • memory/2464-35-0x0000000005C80000-0x0000000005CCC000-memory.dmp

    Filesize

    304KB

  • memory/2464-42-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/2464-29-0x0000000005570000-0x00000000058C4000-memory.dmp

    Filesize

    3.3MB

  • memory/2464-38-0x0000000006120000-0x0000000006142000-memory.dmp

    Filesize

    136KB

  • memory/2464-15-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/2464-28-0x0000000005500000-0x0000000005566000-memory.dmp

    Filesize

    408KB

  • memory/2464-20-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/2464-27-0x0000000005490000-0x00000000054F6000-memory.dmp

    Filesize

    408KB

  • memory/2464-17-0x0000000004E60000-0x0000000005488000-memory.dmp

    Filesize

    6.2MB

  • memory/2464-14-0x0000000002250000-0x0000000002286000-memory.dmp

    Filesize

    216KB

  • memory/3272-57-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

    Filesize

    304KB

  • memory/3272-71-0x0000000007F00000-0x0000000007F11000-memory.dmp

    Filesize

    68KB

  • memory/3272-75-0x0000000008020000-0x0000000008028000-memory.dmp

    Filesize

    32KB

  • memory/3272-74-0x0000000008040000-0x000000000805A000-memory.dmp

    Filesize

    104KB

  • memory/3272-73-0x0000000007F40000-0x0000000007F54000-memory.dmp

    Filesize

    80KB

  • memory/3272-72-0x0000000007F30000-0x0000000007F3E000-memory.dmp

    Filesize

    56KB

  • memory/3272-70-0x0000000007D70000-0x0000000007D7A000-memory.dmp

    Filesize

    40KB

  • memory/3272-69-0x0000000008360000-0x00000000089DA000-memory.dmp

    Filesize

    6.5MB

  • memory/3272-68-0x0000000007C30000-0x0000000007CD3000-memory.dmp

    Filesize

    652KB

  • memory/3272-67-0x0000000007B50000-0x0000000007B6E000-memory.dmp

    Filesize

    120KB

  • memory/3272-56-0x0000000007B90000-0x0000000007BC2000-memory.dmp

    Filesize

    200KB

  • memory/3272-55-0x0000000006AD0000-0x0000000006B1C000-memory.dmp

    Filesize

    304KB

  • memory/3272-44-0x0000000006390000-0x00000000066E4000-memory.dmp

    Filesize

    3.3MB

  • memory/4600-9-0x0000000005990000-0x00000000059A8000-memory.dmp

    Filesize

    96KB

  • memory/4600-10-0x0000000005A00000-0x0000000005A1E000-memory.dmp

    Filesize

    120KB

  • memory/4600-5-0x0000000005910000-0x000000000591A000-memory.dmp

    Filesize

    40KB

  • memory/4600-1-0x0000000000E50000-0x0000000000E6A000-memory.dmp

    Filesize

    104KB

  • memory/4600-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

    Filesize

    4KB

  • memory/4600-6-0x0000000005B30000-0x0000000005BA6000-memory.dmp

    Filesize

    472KB

  • memory/4600-7-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

    Filesize

    4KB

  • memory/4600-8-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4600-3-0x0000000005850000-0x00000000058E2000-memory.dmp

    Filesize

    584KB

  • memory/4600-4-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4600-2-0x0000000005FF0000-0x0000000006594000-memory.dmp

    Filesize

    5.6MB

  • memory/4600-19-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4660-16-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4660-12-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4660-18-0x0000000005070000-0x000000000510C000-memory.dmp

    Filesize

    624KB

  • memory/4660-41-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4660-98-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4660-99-0x0000000074A00000-0x00000000751B0000-memory.dmp

    Filesize

    7.7MB