Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 13:24
Static task
static1
General
-
Target
NetCat Loader.exe
-
Size
76KB
-
MD5
1a56b39b62cff3bf7a75a708f6a11762
-
SHA1
180d91a57ebb95a81bfaa394bca35c123efa916e
-
SHA256
ad34f6a17ee318591b59ac4fbc300c53808630e4f163b644a58eadc85057348a
-
SHA512
b86dfa4287e283fd7e734cc3897589c2bb6b98e35f1c82a6ab50f271baf8a9748a125a6c04425ccdf93566ddacb453290a9a63e5fc0d2797b70fb70b6dac03fb
-
SSDEEP
1536:JqDtM7DwroXh9bSQ6/jyrV9nmRWnXzWb6Alyj:EwblSlryrV9nmwPeyj
Malware Config
Extracted
xworm
194.59.31.87:1111
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000a00000001225c-5.dat family_xworm behavioral1/memory/2184-8-0x0000000001030000-0x0000000001046000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 900 powershell.exe 2724 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2184 System32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2184 System32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2724 powershell.exe 900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2184 System32.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeDebugPrivilege 2184 System32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2184 2792 NetCat Loader.exe 29 PID 2792 wrote to memory of 2184 2792 NetCat Loader.exe 29 PID 2792 wrote to memory of 2184 2792 NetCat Loader.exe 29 PID 2792 wrote to memory of 2860 2792 NetCat Loader.exe 30 PID 2792 wrote to memory of 2860 2792 NetCat Loader.exe 30 PID 2792 wrote to memory of 2860 2792 NetCat Loader.exe 30 PID 2184 wrote to memory of 2724 2184 System32.exe 32 PID 2184 wrote to memory of 2724 2184 System32.exe 32 PID 2184 wrote to memory of 2724 2184 System32.exe 32 PID 2184 wrote to memory of 900 2184 System32.exe 34 PID 2184 wrote to memory of 900 2184 System32.exe 34 PID 2184 wrote to memory of 900 2184 System32.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe"C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\System32.exe"C:\Users\Admin\AppData\Roaming\System32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Thanks For Using.txt2⤵PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD59a465b1cdf10d72ed174a67f35ce77a5
SHA140499772d21672e38ef408fe966c7961419c4824
SHA2560701380add74ae10e4825ee89c8128ed8cb9479f3231bcdb00a0f61d763ff5d5
SHA5123c629eb33ae0624dc1832e0c0b8d8ffd23450fd3356326456069a2fe8b5df2bc774dff2a2c8f2c5ca37741f7326bf9cae50e37602adb1013c5b6b4abb7d6fe0a
-
Filesize
63KB
MD566bbe5829a613fedad7f79e2c6273448
SHA157314396a65e08b7bfc5f0b8cdfa9a050579d9d9
SHA25672499a032c26ef7031b942590e4dd2e28d60b332620c7d2dc42bc4b70995e0dd
SHA5129b0ea0bb6a4a6ae75c6463f2bc3b5bd012a40a89f491868979230b850b948240b40326c703211edd349911e97a218bf77d01d06f254c33d83939c21a152efae3
-
Filesize
57B
MD5f9cfd0c4da0a9a068f8a26ee31c85036
SHA1ea75b71cfdf7364eacfafcaac0421f9c80a2b4e5
SHA256e52f33ee65ceb7e5fe9cd47744888c089c37ba7dbadeaf345e75b5cadd43ee2d
SHA512f81823ed92d8f5aa299d0164f59fb77a3af4c6a9ca5a98e0d4b33104ec7f15ef19037d4bb4f3b2c8c1ca156bac2253f5052eb801468db73d71a67b10405e4b51