Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10real shit/...ty.dll
windows10-2004-x64
3real shit/...al.exe
windows10-2004-x64
10real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3real shit/...-0.dll
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 14:37
Behavioral task
behavioral1
Sample
real shit/Accessibility.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
real shit/SamsungCommisionExternal.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
real shit/api-ms-win-core-heap-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
real shit/api-ms-win-core-interlocked-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
real shit/api-ms-win-core-libraryloader-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
real shit/api-ms-win-core-localization-l1-2-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
real shit/api-ms-win-core-memory-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
real shit/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
real shit/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
real shit/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10v2004-20241007-en
General
-
Target
real shit/SamsungCommisionExternal.exe
-
Size
63KB
-
MD5
6f30a565049364df3068b5bc88fd36d6
-
SHA1
2ca485eb96156bfc561acd69649cf3339da6c610
-
SHA256
e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d
-
SHA512
c01edc2fe4e5ad26b9511cc0bc114221878cf961b436a091a79611ce27da69ce7cf58afdcc71d295ad25f08701b1eb16c0c298fd22fbcb69004f760ea2b89ffe
-
SSDEEP
1536:9VbfG3pj8mIfpubPOggHEyj26+6POhjV5yD/9:/fGZrIf0bPDgkyjnPOhp5U9
Malware Config
Extracted
xworm
127.0.0.1:24707
modified-begun.gl.at.ply.gg:24707
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/2804-1-0x0000000000490000-0x00000000004A6000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3612 powershell.exe 2656 powershell.exe 1176 powershell.exe 4392 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation SamsungCommisionExternal.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk SamsungCommisionExternal.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk SamsungCommisionExternal.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Smasmug = "C:\\Users\\Admin\\AppData\\Roaming\\Smasmug" SamsungCommisionExternal.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3612 powershell.exe 3612 powershell.exe 2656 powershell.exe 2656 powershell.exe 1176 powershell.exe 1176 powershell.exe 4392 powershell.exe 4392 powershell.exe 2804 SamsungCommisionExternal.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2804 SamsungCommisionExternal.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeDebugPrivilege 2656 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 4392 powershell.exe Token: SeDebugPrivilege 2804 SamsungCommisionExternal.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2804 SamsungCommisionExternal.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2804 wrote to memory of 3612 2804 SamsungCommisionExternal.exe 83 PID 2804 wrote to memory of 3612 2804 SamsungCommisionExternal.exe 83 PID 2804 wrote to memory of 2656 2804 SamsungCommisionExternal.exe 85 PID 2804 wrote to memory of 2656 2804 SamsungCommisionExternal.exe 85 PID 2804 wrote to memory of 1176 2804 SamsungCommisionExternal.exe 89 PID 2804 wrote to memory of 1176 2804 SamsungCommisionExternal.exe 89 PID 2804 wrote to memory of 4392 2804 SamsungCommisionExternal.exe 91 PID 2804 wrote to memory of 4392 2804 SamsungCommisionExternal.exe 91 PID 2804 wrote to memory of 2604 2804 SamsungCommisionExternal.exe 99 PID 2804 wrote to memory of 2604 2804 SamsungCommisionExternal.exe 99 PID 2604 wrote to memory of 3640 2604 cmd.exe 101 PID 2604 wrote to memory of 3640 2604 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\real shit\SamsungCommisionExternal.exe"C:\Users\Admin\AppData\Local\Temp\real shit\SamsungCommisionExternal.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\real shit\SamsungCommisionExternal.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SamsungCommisionExternal.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Smasmug'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Smasmug'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp48CC.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD50aa63dbb46d451e47a7a682c64af776d
SHA13b0026f2dae8e9c491ccaa40133755779de35aaa
SHA2569158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b
SHA5124d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
186B
MD5e853addec43737eca5fdc74033ae16cb
SHA10a8adb87a4d65888b2665b539b6e99aa7ca384dd
SHA2566098005d68a138f8e944525d9ba6a1e9564082120c100eb3548b6e466d58eb0b
SHA512dd7277abdaed08126492496c14d1ae0e158ab9b0524e59ce7b42fc41b52149f1f797bfaef7f5cdb98efd4200e3b05886a64d2920b3e308585888b7ba53423991