Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
6s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/01/2025, 15:47
Behavioral task
behavioral1
Sample
SamsungCommisionExternal.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
SamsungCommisionExternal.exe
Resource
win11-20241007-en
General
-
Target
SamsungCommisionExternal.exe
-
Size
63KB
-
MD5
6f30a565049364df3068b5bc88fd36d6
-
SHA1
2ca485eb96156bfc561acd69649cf3339da6c610
-
SHA256
e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d
-
SHA512
c01edc2fe4e5ad26b9511cc0bc114221878cf961b436a091a79611ce27da69ce7cf58afdcc71d295ad25f08701b1eb16c0c298fd22fbcb69004f760ea2b89ffe
-
SSDEEP
1536:9VbfG3pj8mIfpubPOggHEyj26+6POhjV5yD/9:/fGZrIf0bPDgkyjnPOhp5U9
Malware Config
Extracted
xworm
127.0.0.1:24707
modified-begun.gl.at.ply.gg:24707
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4776-1-0x00000000000F0000-0x0000000000106000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 704 powershell.exe 3820 powershell.exe 2992 powershell.exe 2472 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk SamsungCommisionExternal.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk SamsungCommisionExternal.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Smasmug = "C:\\Users\\Admin\\AppData\\Roaming\\Smasmug" SamsungCommisionExternal.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 704 powershell.exe 704 powershell.exe 3820 powershell.exe 3820 powershell.exe 2992 powershell.exe 2992 powershell.exe 2472 powershell.exe 2472 powershell.exe 4776 SamsungCommisionExternal.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4776 SamsungCommisionExternal.exe Token: SeDebugPrivilege 704 powershell.exe Token: SeDebugPrivilege 3820 powershell.exe Token: SeDebugPrivilege 2992 powershell.exe Token: SeDebugPrivilege 2472 powershell.exe Token: SeDebugPrivilege 4776 SamsungCommisionExternal.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4776 SamsungCommisionExternal.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4776 wrote to memory of 704 4776 SamsungCommisionExternal.exe 78 PID 4776 wrote to memory of 704 4776 SamsungCommisionExternal.exe 78 PID 4776 wrote to memory of 3820 4776 SamsungCommisionExternal.exe 80 PID 4776 wrote to memory of 3820 4776 SamsungCommisionExternal.exe 80 PID 4776 wrote to memory of 2992 4776 SamsungCommisionExternal.exe 82 PID 4776 wrote to memory of 2992 4776 SamsungCommisionExternal.exe 82 PID 4776 wrote to memory of 2472 4776 SamsungCommisionExternal.exe 84 PID 4776 wrote to memory of 2472 4776 SamsungCommisionExternal.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe"C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SamsungCommisionExternal.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Smasmug'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Smasmug'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD55f872f6c9232f591431202b641ba1ded
SHA1a7623c472df4bab5ad67cc09ed7ea4937ee16575
SHA256ab03f8e51cc9b874fc797646edeb914f38e1ea06fa2e88fabc17f058512877e1
SHA512d7b5490002bbe77de860fa63c9bcdbdb5df90172ddea776baeb9d142ec06d788636bc3db15eed2180601cf918a528e19150b6e4d7f69a095722515513934917b
-
Filesize
944B
MD534c8b93dd58a4703db0d6dd86bb21d70
SHA1b53aa49b882070b857951b6638d6da3a03ac2f56
SHA25634b95e4d12196f68f7a030b98190fda89c34b696251ab9ed831e48d983896898
SHA512bba4a86b8a66104ed21fd58717168cdf68b93c801a94ec65e25c2b66c1b9354b9e7c1c01cadde451948e072d96c3fa4994c94ef33aeff9b603e7b5d82f7111e7
-
Filesize
944B
MD5f8c40f7624e23fa92ae2f41e34cfca77
SHA120e742cfe2759ac2adbc16db736a9e143ca7b677
SHA256c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b
SHA512f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82