Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
100s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
-
submitted
01/03/2025, 08:14
General
-
Target
neverlose crack by waite.exe
-
Size
17.8MB
-
MD5
328a0860e1f40bc15be694a240b21348
-
SHA1
a215baba2d1c8b3ccd8330eb7803483597067b58
-
SHA256
351dd177e0a45db020ef0adc9cf1e31e74357c955107ca608edb07b9817353a1
-
SHA512
4c4752697ca93b5dc28c60ff3c32f3fcb7f77b05e2d5c8e3f4ca1f1bdbe06dd8af385aafd17e450290f02944f875855a4a4d976b0a34653f9aba221ae935d542
-
SSDEEP
1536:KqGrHEv1Om9VnhVlvIlBSPAeDbTvREEwhkDfFq6MzOFfs4ZKIhB4Yiw:LG7YBfhVV9AsbTvuvhkDgOFfk8B+w
Malware Config
Extracted
xworm
very-stars.gl.at.ply.gg:23028
-
Install_directory
%ProgramData%
-
install_file
system64.exe
-
telegram
https://api.telegram.org/bot7592133817:AAFoMe-c16pn4My7-EODEINEZeWZ2Milavo/sendMessage?chat_id=6723354517
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 37 IoCs
-
Suspicious use of SendNotifyMessage 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\neverlose crack by waite.exe"C:\Users\Admin\AppData\Local\Temp\neverlose crack by waite.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\neverlose crack by waite.exe"C:\Users\Admin\AppData\Local\Temp\neverlose crack by waite.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
10.8MB