Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    23/01/2025, 12:05

General

  • Target

    Xworm V5.6.exe

  • Size

    14.9MB

  • MD5

    714f51eb76e1d01b1b646962224910a8

  • SHA1

    affe3aba05cdb0ab78fea81be9bae2ffb7dc7a8f

  • SHA256

    6be79ff4d5c370639bfb4c3dbd4f2bc3332a009ccfbda08ed0a88524e3ee5b31

  • SHA512

    a9faa8043b2d9498e78d921e05e3e299ea121af1a95682a70fb76b67df78c8101a6f55fbc1939a2858f282346e35bef9a2ae106bb4a5ae32e84e26107f33c905

  • SSDEEP

    196608:1o/BAe1d4ihvy85JhhYc3BSL1kehn4inje:1eyIhhkRka4i

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3228
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2304
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x3a4 0x3c4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3548
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3228-10-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-8-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-2-0x000001F8690C0000-0x000001F8692B4000-memory.dmp

      Filesize

      2.0MB

    • memory/3228-3-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-4-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-5-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-6-0x00007FFD63170000-0x00007FFD63C32000-memory.dmp

      Filesize

      10.8MB

    • memory/3228-25-0x000001F8682D0000-0x000001F868477000-memory.dmp

      Filesize

      1.7MB

    • memory/3228-11-0x000001F8682D0000-0x000001F868477000-memory.dmp

      Filesize

      1.7MB

    • memory/3228-9-0x000001F8682D0000-0x000001F868477000-memory.dmp

      Filesize

      1.7MB

    • memory/3228-1-0x000001F84CC40000-0x000001F84DB2A000-memory.dmp

      Filesize

      14.9MB

    • memory/3228-0-0x00007FFD63173000-0x00007FFD63175000-memory.dmp

      Filesize

      8KB

    • memory/3228-7-0x00007FFD63173000-0x00007FFD63175000-memory.dmp

      Filesize

      8KB

    • memory/4720-14-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-12-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-18-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-22-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-24-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-23-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-21-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-20-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-19-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB

    • memory/4720-13-0x00000284B80B0000-0x00000284B80B1000-memory.dmp

      Filesize

      4KB