Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/02/2025, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
WindowsApp1.exe
Resource
win7-20240903-en
General
-
Target
WindowsApp1.exe
-
Size
428KB
-
MD5
4e4ef72e167c726a5918dd38c9ec901d
-
SHA1
0d6502c6c0e0e60be7883ea09514b0bd1a1dd1bc
-
SHA256
17bfc5e52bc85dfafe14e428825ae1b36bd9f016c0a26dc2049057e4a4d71e69
-
SHA512
c86161039a7c09bb28614a62f40b34b27f0894fc84ed60ef24919048e0aeebaa0ebe00cd4d5cf2a4537f0f09df2ee3eae666c1ce4ae93711e362ca6591e74f24
-
SSDEEP
12288:h9BE7dl7QqXwB05gNYpnmJ+F06ikMW6uf:zsdlQdB0PmJ+y6ik6
Malware Config
Extracted
xworm
5.0
paul-nw.gl.at.ply.gg:51413
AVvzTAnLyW8qQCcO
-
Install_directory
%AppData%
-
install_file
kev.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000e00000001228d-8.dat family_xworm behavioral1/memory/2752-12-0x0000000000990000-0x00000000009A0000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 2752 .exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 764 WindowsApp1.exe Token: SeDebugPrivilege 2752 .exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 764 wrote to memory of 2752 764 WindowsApp1.exe 31 PID 764 wrote to memory of 2752 764 WindowsApp1.exe 31 PID 764 wrote to memory of 2752 764 WindowsApp1.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe"C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD501f86862e5a3fab03f886eb19089da95
SHA18749ecbbac9f911deaee8d5530ef644ca0270258
SHA256ecfb4e772dd3be3c70e2833558b53c9352466ef193694a32a2a6e4926d810d81
SHA512c03771ab0e115c95c2af29f1ec3e331e90bac38074bd1eeda741a6e9f4f93d7cf55dd2a6354219886e50055730c10a363f264eeadcb2c06a1fd06a3670e41a86