Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XWorm_V5.6...rm.exe
windows7-x64
10XWorm_V5.6...rm.exe
windows10-2004-x64
10XWorm_V5.6...ox.dll
windows7-x64
1XWorm_V5.6...ox.dll
windows10-2004-x64
1XWorm_V5.6...er.bat
windows7-x64
1XWorm_V5.6...er.bat
windows10-2004-x64
1XWorm_V5.6...re.dll
windows7-x64
1XWorm_V5.6...re.dll
windows10-2004-x64
1XWorm_V5.6...ms.dll
windows7-x64
1XWorm_V5.6...ms.dll
windows10-2004-x64
1XWorm_V5.6...I2.dll
windows7-x64
1XWorm_V5.6...I2.dll
windows10-2004-x64
1XWorm_V5.6...or.dll
windows7-x64
1XWorm_V5.6...or.dll
windows10-2004-x64
1XWorm_V5.6...io.dll
windows7-x64
1XWorm_V5.6...io.dll
windows10-2004-x64
1XWorm_V5.6...on.dll
windows7-x64
1XWorm_V5.6...on.dll
windows10-2004-x64
1XWorm_V5.6...ws.dll
windows7-x64
1XWorm_V5.6...ws.dll
windows10-2004-x64
1XWorm_V5.6...at.dll
windows7-x64
1XWorm_V5.6...at.dll
windows10-2004-x64
1XWorm_V5.6...um.dll
windows7-x64
1XWorm_V5.6...um.dll
windows10-2004-x64
1XWorm_V5.6...rd.dll
windows7-x64
1XWorm_V5.6...rd.dll
windows10-2004-x64
1XWorm_V5.6...ss.dll
windows7-x64
1XWorm_V5.6...ss.dll
windows10-2004-x64
1XWorm_V5.6...er.dll
windows7-x64
1XWorm_V5.6...er.dll
windows10-2004-x64
1XWorm_V5.6...er.dll
windows7-x64
1XWorm_V5.6...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2025, 13:47
Behavioral task
behavioral1
Sample
XWorm_V5.6/XWorm V5.6/._cache_Xworm.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XWorm_V5.6/XWorm V5.6/._cache_Xworm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
XWorm_V5.6/XWorm V5.6/FastColoredTextBox.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
XWorm_V5.6/XWorm V5.6/FastColoredTextBox.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
XWorm_V5.6/XWorm V5.6/Fixer.bat
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
XWorm_V5.6/XWorm V5.6/Fixer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XWorm_V5.6/XWorm V5.6/GMap.NET.Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XWorm_V5.6/XWorm V5.6/GMap.NET.Core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XWorm_V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
XWorm_V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XWorm_V5.6/XWorm V5.6/Guna.UI2.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
XWorm_V5.6/XWorm V5.6/Guna.UI2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
XWorm_V5.6/XWorm V5.6/IconExtractor.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
XWorm_V5.6/XWorm V5.6/IconExtractor.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XWorm_V5.6/XWorm V5.6/NAudio.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
XWorm_V5.6/XWorm V5.6/NAudio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XWorm_V5.6/XWorm V5.6/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
XWorm_V5.6/XWorm V5.6/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
XWorm_V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
XWorm_V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Chat.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Chat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Chromium.dll
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Chromium.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Clipboard.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Clipboard.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
XWorm_V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
XWorm_V5.6/XWorm V5.6/Plugins/FileManager.dll
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
XWorm_V5.6/XWorm V5.6/Plugins/FileManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
XWorm_V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
XWorm_V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
Resource
win10v2004-20241007-en
General
-
Target
XWorm_V5.6/XWorm V5.6/._cache_Xworm.exe
-
Size
75KB
-
MD5
f63d6c11422e7e0ca83981e8dae62f96
-
SHA1
c9c6088a764b07e7d438ad603a8bfcd9972f2b06
-
SHA256
7ed1b4c14c9dfc97094ac40c5fb6c1fe109e4bfcbc953f2ba4331686388be531
-
SHA512
b4dc1037a4fa38482e355aa3f4ac8288aa926dd7c24ee5cd260b5418ebd9ba6a53ef41f3e862eaa71795a2d0b7407fc9d700ec9a224d45f4b7af1e2063f991d9
-
SSDEEP
1536:GMSF34nJN7Z6/hv0beO3cCv6pDZOQlW3TDsdiv:RLjE/hv0b/DmOQlW3fXv
Malware Config
Extracted
xworm
simply-exotic.gl.at.ply.gg:27183
-
Install_directory
%Temp%
-
install_file
Windows.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/452-1-0x00000000006E0000-0x00000000006FA000-memory.dmp family_xworm behavioral2/files/0x000b000000023d23-60.dat family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4436 powershell.exe 4576 powershell.exe 4808 powershell.exe 988 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation ._cache_Xworm.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\User.lnk ._cache_Xworm.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\User.lnk ._cache_Xworm.exe -
Executes dropped EXE 1 IoCs
pid Process 4388 User -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\User = "C:\\Users\\Admin\\AppData\\Local\\Temp\\User" ._cache_Xworm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3084 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4436 powershell.exe 4436 powershell.exe 4576 powershell.exe 4576 powershell.exe 4808 powershell.exe 4808 powershell.exe 988 powershell.exe 988 powershell.exe 452 ._cache_Xworm.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 452 ._cache_Xworm.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeDebugPrivilege 988 powershell.exe Token: SeDebugPrivilege 452 ._cache_Xworm.exe Token: SeDebugPrivilege 4388 User -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 452 ._cache_Xworm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 452 wrote to memory of 4436 452 ._cache_Xworm.exe 85 PID 452 wrote to memory of 4436 452 ._cache_Xworm.exe 85 PID 452 wrote to memory of 4576 452 ._cache_Xworm.exe 89 PID 452 wrote to memory of 4576 452 ._cache_Xworm.exe 89 PID 452 wrote to memory of 4808 452 ._cache_Xworm.exe 91 PID 452 wrote to memory of 4808 452 ._cache_Xworm.exe 91 PID 452 wrote to memory of 988 452 ._cache_Xworm.exe 95 PID 452 wrote to memory of 988 452 ._cache_Xworm.exe 95 PID 452 wrote to memory of 1920 452 ._cache_Xworm.exe 97 PID 452 wrote to memory of 1920 452 ._cache_Xworm.exe 97 PID 452 wrote to memory of 4500 452 ._cache_Xworm.exe 109 PID 452 wrote to memory of 4500 452 ._cache_Xworm.exe 109 PID 452 wrote to memory of 1184 452 ._cache_Xworm.exe 111 PID 452 wrote to memory of 1184 452 ._cache_Xworm.exe 111 PID 1184 wrote to memory of 3084 1184 cmd.exe 113 PID 1184 wrote to memory of 3084 1184 cmd.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe"C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_Xworm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\User'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'User'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "User" /tr "C:\Users\Admin\AppData\Local\Temp\User"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1920
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "User"2⤵PID:4500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8FA8.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\UserC:\Users\Admin\AppData\Local\Temp\User1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5e58749a7a1826f6ea62df1e2ef63a32b
SHA1c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA2560e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
SHA5124cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70
-
Filesize
944B
MD5f9181f64418cae3d8eb73498c74ea2c2
SHA1b034df207dcd05550132de526b89fc7f45e77f3a
SHA256969ebc05f9daffc5ea9c54fa23cfa46ba967cfa4370364e8f47ed988aa0846a0
SHA512ce0ecccdb4bed314f67e7271d1e4c86d0e4db89f3aa37755de355fecc596fc1d7c0a86e0a053dbce2db834cf5f4c382c503ed64880cb8c1ed5155ed70637865c
-
Filesize
75KB
MD5f63d6c11422e7e0ca83981e8dae62f96
SHA1c9c6088a764b07e7d438ad603a8bfcd9972f2b06
SHA2567ed1b4c14c9dfc97094ac40c5fb6c1fe109e4bfcbc953f2ba4331686388be531
SHA512b4dc1037a4fa38482e355aa3f4ac8288aa926dd7c24ee5cd260b5418ebd9ba6a53ef41f3e862eaa71795a2d0b7407fc9d700ec9a224d45f4b7af1e2063f991d9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
187B
MD59136e6602660132fb07f3276e6fdd6e7
SHA110f94348c3f8e1ca18b5e0f9969e932d70932919
SHA25648d520d16c2bd042655a5a9c912bed01e27281d488fb8e74eac14ee4c68fd5f1
SHA51226859a53485d7eeacd887373d0627d6ea85b1c3a71b661e2f23f264488c80ed73d4760b30bfe30b6eacfef59472cabe0bc54827ff3929a0ef587b4a920726ed5