Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    32s
  • max time network
    35s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250217-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    28/02/2025, 13:52

General

  • Target

    Nixware.exe

  • Size

    75KB

  • MD5

    ab5dbeb065e58170f4bdce27e5cac036

  • SHA1

    a45cf20ba7700225594c0228b60ebf67b47ae9a4

  • SHA256

    73f7c7fbf82f23ac548ce23caab9a89935f5e992ca07a01a52c4b897b625791c

  • SHA512

    0ec79ced728f0c3a8063b7e3f64d02f0c06714fa70422170445e6ee786bd6485847e04bb20986bb48debd1ceb43eed7635082ee13b881e5701004cc7a911fee9

  • SSDEEP

    1536:f4AgapwMk06Ta7qbWK/kGxup6SICOqmFlc2:gAL6nha7qbWoluvTOqC62

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:8848

on-allow.gl.at.ply.gg:8848

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nixware.exe
    "C:\Users\Admin\AppData\Local\Temp\Nixware.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/524-0-0x00007FFE5F713000-0x00007FFE5F715000-memory.dmp

    Filesize

    8KB

  • memory/524-1-0x0000000000E70000-0x0000000000E8A000-memory.dmp

    Filesize

    104KB

  • memory/524-2-0x00007FFE5F710000-0x00007FFE601D2000-memory.dmp

    Filesize

    10.8MB

  • memory/524-3-0x00007FFE5F710000-0x00007FFE601D2000-memory.dmp

    Filesize

    10.8MB