Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
04/02/2025, 20:50
250204-zmyk3stkep 10Analysis
-
max time kernel
72s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:50
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
29472f37159588f215ab330519c41c8e
-
SHA1
e1b7917270b70946a4b96c54fb04481b78c9c4a2
-
SHA256
17cb8ec97c8e4939edea0a9b3e1ce1597758a5131b2ea2b63316cc2e538b10bf
-
SHA512
1c118c98f52f3db77af0afa448f6b002065a476332bb6b56feca7ba7493cef6d9ab3dc5cf5fed2a2f68cb93782f5741be5b81adf050a520d782c8559449031a5
-
SSDEEP
384:YEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisxF:dVa+vNtg+PB93Tw49FzVFE9juOjh2bf
Malware Config
Extracted
Family
xworm
Version
5.0
C2
0.0.0.0:7000
Mutex
kIy6rQrEWqfuHMNk
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2004-1-0x0000000000500000-0x000000000050E000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2004 XClient.exe Token: SeDebugPrivilege 1944 taskmgr.exe Token: SeSystemProfilePrivilege 1944 taskmgr.exe Token: SeCreateGlobalPrivilege 1944 taskmgr.exe Token: 33 1944 taskmgr.exe Token: SeIncBasePriorityPrivilege 1944 taskmgr.exe Token: SeBackupPrivilege 4044 svchost.exe Token: SeRestorePrivilege 4044 svchost.exe Token: SeSecurityPrivilege 4044 svchost.exe Token: SeTakeOwnershipPrivilege 4044 svchost.exe Token: 35 4044 svchost.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1944
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4044