Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 13:41

General

  • Target

    idk.exe

  • Size

    94KB

  • MD5

    f88781b7415e7b04fd13b1bbbf2009b2

  • SHA1

    df9072bf61727db083155c04b47ce48744b23ee5

  • SHA256

    ccaf48cc722a2f0f9766cc4e83c1469e498fc67d2f8ed96942a5764d3591050e

  • SHA512

    6c16f8287f2f14b452025be0638fb827fa6e4a3556b21119c6195bc066d577f2c1df9a8b3f500f7e56d2b33e0552c7cbec8730bd3ac14704a6250280b1aac3db

  • SSDEEP

    1536:BItB2JRcId+cS7K/aATFcmJi1vJYbmG0VaTCVp8tA8qbQXpPQ8Qep+MDaj361dw:CyFdDSWjB0vcL0VwCz8+8qbwPtVkOg3r

Malware Config

Extracted

Family

xworm

C2

IDKTOBEHONESTNIGAS-56344.portmap.io:56344

Attributes
  • Install_directory

    %LocalAppData%

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\idk.exe
    "C:\Users\Admin\AppData\Local\Temp\idk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Roaming\svchost.scr
      "C:\Users\Admin\AppData\Roaming\svchost.scr" /S
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.scr'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.scr'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.scr'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2688
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.scr"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1748
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {F4CB7DCF-D584-430D-A106-27E208A81207} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\svchost.scr
      C:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
    • C:\Users\Admin\AppData\Local\svchost.scr
      C:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:548
    • C:\Users\Admin\AppData\Local\svchost.scr
      C:\Users\Admin\AppData\Local\svchost.scr "C:\Users\Admin\AppData\Local\svchost.scr"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    1170b422d714fd6ceb65f7fcacbdf109

    SHA1

    662e77023b4b5e44cb9ee07ffce2764a479f9d45

    SHA256

    fe37d280d546a92ba6a963e39bcce1af7901af827949d16f001f308631ed594d

    SHA512

    ae5a0586a18d5522a5b9b1d40831333ad19cb39e3ab01d2c4eec21b8c9eb10d8406dbd9d32f775a6300ce649987deca96ff75c8422d1c3497f6de3c52ec597bb

  • C:\Users\Admin\AppData\Roaming\svchost.scr

    Filesize

    79KB

    MD5

    0b192c8ec04f4dcd360957eb478221d2

    SHA1

    522a5c7336a31c23efec4b8ccab7ce7c17d620d4

    SHA256

    ea6a26539f74891663a03fc3cf348ef53c14295ef3662b9a29b211a8d0503e1c

    SHA512

    7d5dd7c9aca799a8dc15eea9bf767ca6c7e2145ad848d2b2cefb3548cffb30bbbb3e3933aac7c602e4a1b5f02e14e46b7edbcc3945e1aa2e3cc6219941e90eb6

  • memory/548-44-0x00000000002A0000-0x00000000002BA000-memory.dmp

    Filesize

    104KB

  • memory/2552-1-0x0000000000BF0000-0x0000000000C0E000-memory.dmp

    Filesize

    120KB

  • memory/2552-0-0x000007FEF5023000-0x000007FEF5024000-memory.dmp

    Filesize

    4KB

  • memory/2584-41-0x0000000000350000-0x000000000036A000-memory.dmp

    Filesize

    104KB

  • memory/2652-21-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

    Filesize

    2.9MB

  • memory/2652-22-0x00000000003A0000-0x00000000003A8000-memory.dmp

    Filesize

    32KB

  • memory/2736-14-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2736-15-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

    Filesize

    32KB

  • memory/3012-8-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

    Filesize

    9.9MB

  • memory/3012-36-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

    Filesize

    9.9MB

  • memory/3012-37-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

    Filesize

    9.9MB

  • memory/3012-9-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

    Filesize

    9.9MB

  • memory/3012-7-0x0000000000880000-0x000000000089A000-memory.dmp

    Filesize

    104KB

  • memory/3064-46-0x0000000001010000-0x000000000102A000-memory.dmp

    Filesize

    104KB