Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/01/2025, 13:24

250125-qnsa1swmdj 10

24/01/2025, 22:04

250124-1y8e4a1lbz 10

Analysis

  • max time kernel
    32s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 13:24

General

  • Target

    NetCat Loader.exe

  • Size

    76KB

  • MD5

    1a56b39b62cff3bf7a75a708f6a11762

  • SHA1

    180d91a57ebb95a81bfaa394bca35c123efa916e

  • SHA256

    ad34f6a17ee318591b59ac4fbc300c53808630e4f163b644a58eadc85057348a

  • SHA512

    b86dfa4287e283fd7e734cc3897589c2bb6b98e35f1c82a6ab50f271baf8a9748a125a6c04425ccdf93566ddacb453290a9a63e5fc0d2797b70fb70b6dac03fb

  • SSDEEP

    1536:JqDtM7DwroXh9bSQ6/jyrV9nmRWnXzWb6Alyj:EwblSlryrV9nmwPeyj

Malware Config

Extracted

Family

xworm

C2

194.59.31.87:1111

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Users\Admin\AppData\Roaming\System32.exe
      "C:\Users\Admin\AppData\Roaming\System32.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:900
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Thanks For Using.txt
      2⤵
        PID:2860

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      9a465b1cdf10d72ed174a67f35ce77a5

      SHA1

      40499772d21672e38ef408fe966c7961419c4824

      SHA256

      0701380add74ae10e4825ee89c8128ed8cb9479f3231bcdb00a0f61d763ff5d5

      SHA512

      3c629eb33ae0624dc1832e0c0b8d8ffd23450fd3356326456069a2fe8b5df2bc774dff2a2c8f2c5ca37741f7326bf9cae50e37602adb1013c5b6b4abb7d6fe0a

    • C:\Users\Admin\AppData\Roaming\System32.exe

      Filesize

      63KB

      MD5

      66bbe5829a613fedad7f79e2c6273448

      SHA1

      57314396a65e08b7bfc5f0b8cdfa9a050579d9d9

      SHA256

      72499a032c26ef7031b942590e4dd2e28d60b332620c7d2dc42bc4b70995e0dd

      SHA512

      9b0ea0bb6a4a6ae75c6463f2bc3b5bd012a40a89f491868979230b850b948240b40326c703211edd349911e97a218bf77d01d06f254c33d83939c21a152efae3

    • C:\Users\Admin\AppData\Roaming\Thanks For Using.txt

      Filesize

      57B

      MD5

      f9cfd0c4da0a9a068f8a26ee31c85036

      SHA1

      ea75b71cfdf7364eacfafcaac0421f9c80a2b4e5

      SHA256

      e52f33ee65ceb7e5fe9cd47744888c089c37ba7dbadeaf345e75b5cadd43ee2d

      SHA512

      f81823ed92d8f5aa299d0164f59fb77a3af4c6a9ca5a98e0d4b33104ec7f15ef19037d4bb4f3b2c8c1ca156bac2253f5052eb801468db73d71a67b10405e4b51

    • memory/900-24-0x0000000002490000-0x0000000002498000-memory.dmp

      Filesize

      32KB

    • memory/900-23-0x000000001B230000-0x000000001B512000-memory.dmp

      Filesize

      2.9MB

    • memory/2184-8-0x0000000001030000-0x0000000001046000-memory.dmp

      Filesize

      88KB

    • memory/2184-11-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2184-10-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2184-25-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2184-26-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2724-16-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

      Filesize

      2.9MB

    • memory/2724-17-0x0000000002220000-0x0000000002228000-memory.dmp

      Filesize

      32KB

    • memory/2792-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

      Filesize

      4KB

    • memory/2792-1-0x0000000000830000-0x000000000084A000-memory.dmp

      Filesize

      104KB