Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
28/02/2025, 15:43
Behavioral task
behavioral1
Sample
ExcellentFree.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ExcellentFree.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
ExcellentFree.exe
Resource
win10ltsc2021-20250217-en
General
-
Target
ExcellentFree.exe
-
Size
76KB
-
MD5
8cc568f48114422b0ca792dc8ce6009a
-
SHA1
bbe67dabd894ac2e45dc8027c6e3000f73ec97d7
-
SHA256
7a3d86182ae45a6be17ef36d1f12463b398c165a7e6fe4aa80e56ceab7f036eb
-
SHA512
45fe66a17c0473c0a4967d501d6f28f7a41fdce03ec31c46fb11ffd5fd848493578effbc36b4247ae49b987c41c3a559a9185dfdd0fd42468f30c310bea7bcc4
-
SSDEEP
1536:p1TUp7kYt63AuSN5z5UJrh+bILdScPA6BiHGOwKZRWX2emk:1YY32Uf+bmMe7OHZRvemk
Malware Config
Extracted
xworm
cameras-happen.gl.at.ply.gg:23386
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/2760-1-0x0000000000460000-0x000000000047A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 464 powershell.exe 4416 powershell.exe 3660 powershell.exe 64 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation ExcellentFree.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ExcellentFree.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk ExcellentFree.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" ExcellentFree.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3660 powershell.exe 3660 powershell.exe 64 powershell.exe 64 powershell.exe 464 powershell.exe 464 powershell.exe 4416 powershell.exe 4416 powershell.exe 2760 ExcellentFree.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2760 ExcellentFree.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeIncreaseQuotaPrivilege 3660 powershell.exe Token: SeSecurityPrivilege 3660 powershell.exe Token: SeTakeOwnershipPrivilege 3660 powershell.exe Token: SeLoadDriverPrivilege 3660 powershell.exe Token: SeSystemProfilePrivilege 3660 powershell.exe Token: SeSystemtimePrivilege 3660 powershell.exe Token: SeProfSingleProcessPrivilege 3660 powershell.exe Token: SeIncBasePriorityPrivilege 3660 powershell.exe Token: SeCreatePagefilePrivilege 3660 powershell.exe Token: SeBackupPrivilege 3660 powershell.exe Token: SeRestorePrivilege 3660 powershell.exe Token: SeShutdownPrivilege 3660 powershell.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeSystemEnvironmentPrivilege 3660 powershell.exe Token: SeRemoteShutdownPrivilege 3660 powershell.exe Token: SeUndockPrivilege 3660 powershell.exe Token: SeManageVolumePrivilege 3660 powershell.exe Token: 33 3660 powershell.exe Token: 34 3660 powershell.exe Token: 35 3660 powershell.exe Token: 36 3660 powershell.exe Token: SeDebugPrivilege 64 powershell.exe Token: SeIncreaseQuotaPrivilege 64 powershell.exe Token: SeSecurityPrivilege 64 powershell.exe Token: SeTakeOwnershipPrivilege 64 powershell.exe Token: SeLoadDriverPrivilege 64 powershell.exe Token: SeSystemProfilePrivilege 64 powershell.exe Token: SeSystemtimePrivilege 64 powershell.exe Token: SeProfSingleProcessPrivilege 64 powershell.exe Token: SeIncBasePriorityPrivilege 64 powershell.exe Token: SeCreatePagefilePrivilege 64 powershell.exe Token: SeBackupPrivilege 64 powershell.exe Token: SeRestorePrivilege 64 powershell.exe Token: SeShutdownPrivilege 64 powershell.exe Token: SeDebugPrivilege 64 powershell.exe Token: SeSystemEnvironmentPrivilege 64 powershell.exe Token: SeRemoteShutdownPrivilege 64 powershell.exe Token: SeUndockPrivilege 64 powershell.exe Token: SeManageVolumePrivilege 64 powershell.exe Token: 33 64 powershell.exe Token: 34 64 powershell.exe Token: 35 64 powershell.exe Token: 36 64 powershell.exe Token: SeDebugPrivilege 464 powershell.exe Token: SeIncreaseQuotaPrivilege 464 powershell.exe Token: SeSecurityPrivilege 464 powershell.exe Token: SeTakeOwnershipPrivilege 464 powershell.exe Token: SeLoadDriverPrivilege 464 powershell.exe Token: SeSystemProfilePrivilege 464 powershell.exe Token: SeSystemtimePrivilege 464 powershell.exe Token: SeProfSingleProcessPrivilege 464 powershell.exe Token: SeIncBasePriorityPrivilege 464 powershell.exe Token: SeCreatePagefilePrivilege 464 powershell.exe Token: SeBackupPrivilege 464 powershell.exe Token: SeRestorePrivilege 464 powershell.exe Token: SeShutdownPrivilege 464 powershell.exe Token: SeDebugPrivilege 464 powershell.exe Token: SeSystemEnvironmentPrivilege 464 powershell.exe Token: SeRemoteShutdownPrivilege 464 powershell.exe Token: SeUndockPrivilege 464 powershell.exe Token: SeManageVolumePrivilege 464 powershell.exe Token: 33 464 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2760 ExcellentFree.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2760 wrote to memory of 3660 2760 ExcellentFree.exe 90 PID 2760 wrote to memory of 3660 2760 ExcellentFree.exe 90 PID 2760 wrote to memory of 64 2760 ExcellentFree.exe 94 PID 2760 wrote to memory of 64 2760 ExcellentFree.exe 94 PID 2760 wrote to memory of 464 2760 ExcellentFree.exe 96 PID 2760 wrote to memory of 464 2760 ExcellentFree.exe 96 PID 2760 wrote to memory of 4416 2760 ExcellentFree.exe 98 PID 2760 wrote to memory of 4416 2760 ExcellentFree.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExcellentFree.exe"C:\Users\Admin\AppData\Local\Temp\ExcellentFree.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExcellentFree.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ExcellentFree.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53eb3833f769dd890afc295b977eab4b4
SHA1e857649b037939602c72ad003e5d3698695f436f
SHA256c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
SHA512c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
-
Filesize
1KB
MD5c67441dfa09f61bca500bb43407c56b8
SHA15a56cf7cbeb48c109e2128c31b681fac3959157b
SHA25663082da456c124d0bc516d2161d1613db5f3008d903e4066d2c7b4e90b435f33
SHA512325de8b718b3a01df05e20e028c5882240e5fd2e96c771361b776312923ff178f27494a1f5249bf6d7365a99155eb8735a51366e85597008e6a10462e63ee0e8
-
Filesize
1KB
MD584b01acc42baf174c03cb32c25968fb2
SHA1783e414e03b5b15cf79316933d6559e9b1155b4d
SHA256966a03eea4245912a734ac549bd7dd84d383474183e1dfc2011c7369c68681cf
SHA512d027f307afdba928240b96478f3949ed25b5e878a9c5aaf57c492db5bb76eea3324d9472d47d74aa7513dbab8a2e0a7b901b6e6f0dbdf0e387dd20df472911bd
-
Filesize
1KB
MD5de2f0f1eb81111b53da009af10ef181c
SHA198b97f769b3b187c648c8a4e4ec32b7db59f1c13
SHA256ec0299bdbe85e533d346f228af446908c2e388e8e6b130904ff1444e23d2f1f9
SHA512ae2d866fdc311990bcda78504788b62634edc349f681a345490795414f7bd58c16fa95149057a903ccae4779ae5e85e19d1f337d8bd1828778fbc491060c1c80
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82