Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XWorm V5.6.rar
windows7-x64
10XWorm V5.6.rar
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...es.vbs
windows7-x64
1XWorm V5.6...es.vbs
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3Analysis
-
max time kernel
837s -
max time network
843s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 22:14
Behavioral task
behavioral1
Sample
XWorm V5.6.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XWorm V5.6.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win10v2004-20241007-en
General
-
Target
XWorm V5.6/RES/XWorm.Main.resources
-
Size
1.8MB
-
MD5
8d7f5438261b974eaf34287253799b87
-
SHA1
086e994fa1ce12ebeba3c134ec9af69244e8c2e0
-
SHA256
35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
-
SHA512
2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
-
SSDEEP
24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2716 AcroRd32.exe 2716 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2204 2016 cmd.exe 31 PID 2016 wrote to memory of 2204 2016 cmd.exe 31 PID 2016 wrote to memory of 2204 2016 cmd.exe 31 PID 2204 wrote to memory of 2716 2204 rundll32.exe 32 PID 2204 wrote to memory of 2716 2204 rundll32.exe 32 PID 2204 wrote to memory of 2716 2204 rundll32.exe 32 PID 2204 wrote to memory of 2716 2204 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Main.resources"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Main.resources2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Main.resources"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53e7b06aa28ab5d405742f0ddef9457cc
SHA1baf4f55651c4999c100f619b658850928f1087c5
SHA256e15aa5793ae0d162c7d78a4ada22fc855311c73f5dbd481126520572a5c6fa84
SHA5129a99eb427a91b99b9dcafc2d3e7d6ea34968bef693457880bef5f6f2814410d9cec6b2808b8741c312b2458e508cbe0363290a54f77a2a1dfeaa799c6d1b4dcf