Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
idk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
idk.exe
Resource
win10v2004-20241007-en
General
-
Target
idk.exe
-
Size
94KB
-
MD5
f88781b7415e7b04fd13b1bbbf2009b2
-
SHA1
df9072bf61727db083155c04b47ce48744b23ee5
-
SHA256
ccaf48cc722a2f0f9766cc4e83c1469e498fc67d2f8ed96942a5764d3591050e
-
SHA512
6c16f8287f2f14b452025be0638fb827fa6e4a3556b21119c6195bc066d577f2c1df9a8b3f500f7e56d2b33e0552c7cbec8730bd3ac14704a6250280b1aac3db
-
SSDEEP
1536:BItB2JRcId+cS7K/aATFcmJi1vJYbmG0VaTCVp8tA8qbQXpPQ8Qep+MDaj361dw:CyFdDSWjB0vcL0VwCz8+8qbwPtVkOg3r
Malware Config
Extracted
xworm
IDKTOBEHONESTNIGAS-56344.portmap.io:56344
-
Install_directory
%LocalAppData%
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/files/0x00090000000120f1-5.dat family_xworm behavioral1/memory/3012-7-0x0000000000880000-0x000000000089A000-memory.dmp family_xworm behavioral1/memory/2584-41-0x0000000000350000-0x000000000036A000-memory.dmp family_xworm behavioral1/memory/548-44-0x00000000002A0000-0x00000000002BA000-memory.dmp family_xworm behavioral1/memory/3064-46-0x0000000001010000-0x000000000102A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2736 powershell.exe 2652 powershell.exe 2688 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.scr File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.scr -
Executes dropped EXE 4 IoCs
pid Process 3012 svchost.scr 2584 svchost.scr 548 svchost.scr 3064 svchost.scr -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.scr" svchost.scr -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 svchost.scr Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 svchost.scr -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1748 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2736 powershell.exe 2652 powershell.exe 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3012 svchost.scr Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 3012 svchost.scr Token: SeDebugPrivilege 2584 svchost.scr Token: SeDebugPrivilege 548 svchost.scr Token: SeDebugPrivilege 3064 svchost.scr -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3012 2552 idk.exe 30 PID 2552 wrote to memory of 3012 2552 idk.exe 30 PID 2552 wrote to memory of 3012 2552 idk.exe 30 PID 3012 wrote to memory of 2736 3012 svchost.scr 33 PID 3012 wrote to memory of 2736 3012 svchost.scr 33 PID 3012 wrote to memory of 2736 3012 svchost.scr 33 PID 3012 wrote to memory of 2652 3012 svchost.scr 35 PID 3012 wrote to memory of 2652 3012 svchost.scr 35 PID 3012 wrote to memory of 2652 3012 svchost.scr 35 PID 3012 wrote to memory of 2688 3012 svchost.scr 37 PID 3012 wrote to memory of 2688 3012 svchost.scr 37 PID 3012 wrote to memory of 2688 3012 svchost.scr 37 PID 3012 wrote to memory of 1748 3012 svchost.scr 39 PID 3012 wrote to memory of 1748 3012 svchost.scr 39 PID 3012 wrote to memory of 1748 3012 svchost.scr 39 PID 1428 wrote to memory of 2584 1428 taskeng.exe 42 PID 1428 wrote to memory of 2584 1428 taskeng.exe 42 PID 1428 wrote to memory of 2584 1428 taskeng.exe 42 PID 1428 wrote to memory of 548 1428 taskeng.exe 43 PID 1428 wrote to memory of 548 1428 taskeng.exe 43 PID 1428 wrote to memory of 548 1428 taskeng.exe 43 PID 1428 wrote to memory of 3064 1428 taskeng.exe 44 PID 1428 wrote to memory of 3064 1428 taskeng.exe 44 PID 1428 wrote to memory of 3064 1428 taskeng.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Roaming\svchost.scr"C:\Users\Admin\AppData\Roaming\svchost.scr" /S2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.scr"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1748
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F4CB7DCF-D584-430D-A106-27E208A81207} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\svchost.scrC:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Users\Admin\AppData\Local\svchost.scrC:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Users\Admin\AppData\Local\svchost.scrC:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD51170b422d714fd6ceb65f7fcacbdf109
SHA1662e77023b4b5e44cb9ee07ffce2764a479f9d45
SHA256fe37d280d546a92ba6a963e39bcce1af7901af827949d16f001f308631ed594d
SHA512ae5a0586a18d5522a5b9b1d40831333ad19cb39e3ab01d2c4eec21b8c9eb10d8406dbd9d32f775a6300ce649987deca96ff75c8422d1c3497f6de3c52ec597bb
-
Filesize
79KB
MD50b192c8ec04f4dcd360957eb478221d2
SHA1522a5c7336a31c23efec4b8ccab7ce7c17d620d4
SHA256ea6a26539f74891663a03fc3cf348ef53c14295ef3662b9a29b211a8d0503e1c
SHA5127d5dd7c9aca799a8dc15eea9bf767ca6c7e2145ad848d2b2cefb3548cffb30bbbb3e3933aac7c602e4a1b5f02e14e46b7edbcc3945e1aa2e3cc6219941e90eb6