Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2025, 13:47

General

  • Target

    XWorm_V5.6/XWorm V5.6/._cache_Xworm.exe

  • Size

    75KB

  • MD5

    f63d6c11422e7e0ca83981e8dae62f96

  • SHA1

    c9c6088a764b07e7d438ad603a8bfcd9972f2b06

  • SHA256

    7ed1b4c14c9dfc97094ac40c5fb6c1fe109e4bfcbc953f2ba4331686388be531

  • SHA512

    b4dc1037a4fa38482e355aa3f4ac8288aa926dd7c24ee5cd260b5418ebd9ba6a53ef41f3e862eaa71795a2d0b7407fc9d700ec9a224d45f4b7af1e2063f991d9

  • SSDEEP

    1536:GMSF34nJN7Z6/hv0beO3cCv6pDZOQlW3TDsdiv:RLjE/hv0b/DmOQlW3fXv

Malware Config

Extracted

Family

xworm

C2

simply-exotic.gl.at.ply.gg:27183

Attributes
  • Install_directory

    %Temp%

  • install_file

    Windows.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\._cache_Xworm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_Xworm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\User'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'User'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:988
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "User" /tr "C:\Users\Admin\AppData\Local\Temp\User"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1920
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "User"
      2⤵
        PID:4500
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8FA8.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:3084
    • C:\Users\Admin\AppData\Local\Temp\User
      C:\Users\Admin\AppData\Local\Temp\User
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      6d3e9c29fe44e90aae6ed30ccf799ca8

      SHA1

      c7974ef72264bbdf13a2793ccf1aed11bc565dce

      SHA256

      2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

      SHA512

      60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e58749a7a1826f6ea62df1e2ef63a32b

      SHA1

      c0bca21658b8be4f37b71eec9578bfefa44f862d

      SHA256

      0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93

      SHA512

      4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      f9181f64418cae3d8eb73498c74ea2c2

      SHA1

      b034df207dcd05550132de526b89fc7f45e77f3a

      SHA256

      969ebc05f9daffc5ea9c54fa23cfa46ba967cfa4370364e8f47ed988aa0846a0

      SHA512

      ce0ecccdb4bed314f67e7271d1e4c86d0e4db89f3aa37755de355fecc596fc1d7c0a86e0a053dbce2db834cf5f4c382c503ed64880cb8c1ed5155ed70637865c

    • C:\Users\Admin\AppData\Local\Temp\User

      Filesize

      75KB

      MD5

      f63d6c11422e7e0ca83981e8dae62f96

      SHA1

      c9c6088a764b07e7d438ad603a8bfcd9972f2b06

      SHA256

      7ed1b4c14c9dfc97094ac40c5fb6c1fe109e4bfcbc953f2ba4331686388be531

      SHA512

      b4dc1037a4fa38482e355aa3f4ac8288aa926dd7c24ee5cd260b5418ebd9ba6a53ef41f3e862eaa71795a2d0b7407fc9d700ec9a224d45f4b7af1e2063f991d9

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ft3br23w.peo.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp8FA8.tmp.bat

      Filesize

      187B

      MD5

      9136e6602660132fb07f3276e6fdd6e7

      SHA1

      10f94348c3f8e1ca18b5e0f9969e932d70932919

      SHA256

      48d520d16c2bd042655a5a9c912bed01e27281d488fb8e74eac14ee4c68fd5f1

      SHA512

      26859a53485d7eeacd887373d0627d6ea85b1c3a71b661e2f23f264488c80ed73d4760b30bfe30b6eacfef59472cabe0bc54827ff3929a0ef587b4a920726ed5

    • memory/452-2-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/452-68-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/452-1-0x00000000006E0000-0x00000000006FA000-memory.dmp

      Filesize

      104KB

    • memory/452-0-0x00007FFD8D483000-0x00007FFD8D485000-memory.dmp

      Filesize

      8KB

    • memory/452-59-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/452-58-0x00007FFD8D483000-0x00007FFD8D485000-memory.dmp

      Filesize

      8KB

    • memory/4436-19-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/4436-3-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/4436-4-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/4436-12-0x00007FFD8D480000-0x00007FFD8DF41000-memory.dmp

      Filesize

      10.8MB

    • memory/4436-18-0x000002B3369C0000-0x000002B336BDC000-memory.dmp

      Filesize

      2.1MB

    • memory/4436-10-0x000002B336900000-0x000002B336922000-memory.dmp

      Filesize

      136KB

    • memory/4808-43-0x0000024E40180000-0x0000024E4039C000-memory.dmp

      Filesize

      2.1MB