Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Aq.cmd
-
Size
58KB
-
Sample
250122-tvycdsvmav
-
MD5
74bc243ae7a708ff855d909cd335015e
-
SHA1
1ae8eaa354fb74477eff655768044fbe4c70061e
-
SHA256
c1154d35742a0359eb645c7b5db4590096de42bfaee33701ed17758bed0ce8e7
-
SHA512
8c73551601b6683cb417678b6f9306333c7f7ab87ec38a3a2b6e16399e9ea58dd6e21b8de28dfb215bd3d64669095a1fdc3af40ab45963f7824fc434f91b75e1
-
SSDEEP
1536:1eh4s4QPbdRsdhz/IbHYfcOeHJ6xuOyQnQua:kxRsHUbHocBUuOJnNa
Behavioral task
behavioral1
Sample
Aq.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Aq.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Aq.exe
Resource
win11-20241007-en
Malware Config
Extracted
xworm
IDKTOBEHONESTNIGAS-56344.portmap.io:56344
-
Install_directory
%LocalAppData%
Targets
-
-
Target
Aq.cmd
-
Size
58KB
-
MD5
74bc243ae7a708ff855d909cd335015e
-
SHA1
1ae8eaa354fb74477eff655768044fbe4c70061e
-
SHA256
c1154d35742a0359eb645c7b5db4590096de42bfaee33701ed17758bed0ce8e7
-
SHA512
8c73551601b6683cb417678b6f9306333c7f7ab87ec38a3a2b6e16399e9ea58dd6e21b8de28dfb215bd3d64669095a1fdc3af40ab45963f7824fc434f91b75e1
-
SSDEEP
1536:1eh4s4QPbdRsdhz/IbHYfcOeHJ6xuOyQnQua:kxRsHUbHocBUuOJnNa
Score10/10-
Detect Xworm Payload
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1