Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2025, 22:24

General

  • Target

    WindowsApp1.exe

  • Size

    118KB

  • MD5

    0d19cad630767b9be69693ffa5c614da

  • SHA1

    0a72a3d355e094bdc16f03dc9cc660e6031342b9

  • SHA256

    376256408781bf18394e524a1c52b34bcb375289c13c75678069fa57cac0b6a8

  • SHA512

    70854128254cea8bd233d2930f7fd285609a44997b96e326aee19b89defa3971bf70ffe4c8647ec207003aa88ec4186feca25383e707a9f85aa4988d082365e7

  • SSDEEP

    1536:sQowX7LgxGY+lzyUFYEu5J/1JfSUoVZYYhyn/WR1z9P5PG7O4mRT+VsYs:leGY+lpk1SUoNEsv

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

paul-nw.gl.at.ply.gg:51413

Mutex

AVvzTAnLyW8qQCcO

Attributes
  • Install_directory

    %AppData%

  • install_file

    kev.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Local\Temp\.exe
      "C:\Users\Admin\AppData\Local\Temp\.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.exe

    Filesize

    37KB

    MD5

    01f86862e5a3fab03f886eb19089da95

    SHA1

    8749ecbbac9f911deaee8d5530ef644ca0270258

    SHA256

    ecfb4e772dd3be3c70e2833558b53c9352466ef193694a32a2a6e4926d810d81

    SHA512

    c03771ab0e115c95c2af29f1ec3e331e90bac38074bd1eeda741a6e9f4f93d7cf55dd2a6354219886e50055730c10a363f264eeadcb2c06a1fd06a3670e41a86

  • memory/4636-0-0x00007FFEE8BA5000-0x00007FFEE8BA6000-memory.dmp

    Filesize

    4KB

  • memory/4636-1-0x000000001B230000-0x000000001B2D6000-memory.dmp

    Filesize

    664KB

  • memory/4636-2-0x00007FFEE88F0000-0x00007FFEE9291000-memory.dmp

    Filesize

    9.6MB

  • memory/4636-3-0x000000001B7E0000-0x000000001BCAE000-memory.dmp

    Filesize

    4.8MB

  • memory/4636-4-0x000000001BD50000-0x000000001BDEC000-memory.dmp

    Filesize

    624KB

  • memory/4636-6-0x00007FFEE88F0000-0x00007FFEE9291000-memory.dmp

    Filesize

    9.6MB

  • memory/4636-22-0x00007FFEE88F0000-0x00007FFEE9291000-memory.dmp

    Filesize

    9.6MB

  • memory/5060-17-0x00007FFEE62E3000-0x00007FFEE62E5000-memory.dmp

    Filesize

    8KB

  • memory/5060-18-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

    Filesize

    64KB

  • memory/5060-19-0x00007FFEE62E0000-0x00007FFEE6DA1000-memory.dmp

    Filesize

    10.8MB

  • memory/5060-20-0x00007FFEE62E0000-0x00007FFEE6DA1000-memory.dmp

    Filesize

    10.8MB