Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
23/01/2025, 12:05
Behavioral task
behavioral1
Sample
Xworm V5.6.exe
Resource
win10ltsc2021-20250113-en
7 signatures
150 seconds
General
-
Target
Xworm V5.6.exe
-
Size
14.9MB
-
MD5
714f51eb76e1d01b1b646962224910a8
-
SHA1
affe3aba05cdb0ab78fea81be9bae2ffb7dc7a8f
-
SHA256
6be79ff4d5c370639bfb4c3dbd4f2bc3332a009ccfbda08ed0a88524e3ee5b31
-
SHA512
a9faa8043b2d9498e78d921e05e3e299ea121af1a95682a70fb76b67df78c8101a6f55fbc1939a2858f282346e35bef9a2ae106bb4a5ae32e84e26107f33c905
-
SSDEEP
196608:1o/BAe1d4ihvy85JhhYc3BSL1kehn4inje:1eyIhhkRka4i
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Xworm V5.6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Xworm V5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Xworm V5.6.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 3228 Xworm V5.6.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 Xworm V5.6.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 3548 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3548 AUDIODG.EXE Token: SeDebugPrivilege 4720 taskmgr.exe Token: SeSystemProfilePrivilege 4720 taskmgr.exe Token: SeCreateGlobalPrivilege 4720 taskmgr.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 3228 Xworm V5.6.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 3228 Xworm V5.6.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3228
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2304
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3a4 0x3c41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720