Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XWorm V5.6.rar
windows7-x64
10XWorm V5.6.rar
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...es.vbs
windows7-x64
1XWorm V5.6...es.vbs
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3Analysis
-
max time kernel
427s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 22:14
Behavioral task
behavioral1
Sample
XWorm V5.6.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XWorm V5.6.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win10v2004-20241007-en
General
-
Target
XWorm V5.6/RES/XWorm.Main.resources
-
Size
1.8MB
-
MD5
8d7f5438261b974eaf34287253799b87
-
SHA1
086e994fa1ce12ebeba3c134ec9af69244e8c2e0
-
SHA256
35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
-
SHA512
2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
-
SSDEEP
24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5044 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\RES\XWorm.Main.resources"1⤵
- Modifies registry class
PID:4284
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5044