Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/03/2025, 01:26
General
-
Target
SolaraDEVSONLY.exe
-
Size
82KB
-
MD5
c406b02bf6392bf4a6e958032e50cc6f
-
SHA1
8560844a9b1e138acad242f00c61e6dea237c89d
-
SHA256
57db7c05233e6542b02fd939bc29235762127a30f4d24bc0007a86db55be6fea
-
SHA512
5ba085fb37e7795e3ba7291952efd38a440d6c8fe1728ee25d72616ac34fe8003b6f191367b05d5e83d1c6270384689a3ad83090df9a6c30f8bd4d27b67ba2f8
-
SSDEEP
1536:mTVvPHi0bJ1erBLJdNcI7NA4bE+hp2uK62IhOxif6AnDRcodep:mRXsxJ7NlbEihOxq5nlKp
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:60413
thanks-viewers.gl.at.ply.gg:60413
Attributes
-
Install_directory
%AppData%
-
install_file
AggregatorHost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraDEVSONLY.exe"C:\Users\Admin\AppData\Local\Temp\SolaraDEVSONLY.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB