Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/01/2025, 22:14

250126-154qgswnet 10

26/01/2025, 22:10

250126-13tgqsxnaj 10

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2025, 22:10

General

  • Target

    XWorm V5.6/RES/XWorm.Maps.resources

  • Size

    140KB

  • MD5

    ed0eb94f77f681a3600539bb9a6cb6f5

  • SHA1

    b176e3455cd0224448e9d9b4b015789c794d8b06

  • SHA256

    f690fd15ad3c3150a48fd33962b44ec118bb3f9b210f0d0b27e3ee83420c73f4

  • SHA512

    8e097d3d8617043419154821d9721bd4f7e16f12a19f7e8873c8086872540c61e4d932e43515573eac08372a243c0ead855ebfe5488a1e6e53142c44cbb5eebb

  • SSDEEP

    1536:jjbwDfOmcgfteiMWWZoSp9wmLZoSp9wmT:nSfO0tkZAMZAA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Maps.resources"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Maps.resources
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Maps.resources"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    38a54959a560d17071d4f9ddb0dd532b

    SHA1

    7989ba3ee32c6316bbeb84d541c01a8350b94d04

    SHA256

    12972b77a9671ff1c6003880694abd87a02a9d97c727064ce8941720f988a146

    SHA512

    49893184323e835bbe5f39d39c967a1110b2eb214c791c23c54c7fc745a499f6564b536711babfb5a2afefad930b4302448daebe932d3feb529b005cfe577643