Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

CrackLaunc...34.exe

windows7-x64

10

CrackLaunc...34.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2025, 16:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CrackLauncherPass1234.exe

  • Size

    73KB

  • MD5

    fa0d41dc7ca9c40b5bd4ddc84ddcab86

  • SHA1

    86e94ea9ecbcf30f187e68fb8c5afd6ee2891ba9

  • SHA256

    35dc677cc4ded7c3ef15ed4130c13c23c62055f78161c2d93318113c2fd0de66

  • SHA512

    6e4dbfd1edb207bb017da41864811d793f23bb032e0838b24cafaac41f51806333e67b6f69a18d12bc8ca08c6b533d56f9d287c464b445ead92e8bd49e7e5d13

  • SSDEEP

    1536:UrNNEWzOq8we2zoBdJBrsTebq+AiNcgk6UfV4OiUhzQ6QBV7dAM:XWzOlgOfJZbqGKfV4OPhzQ6Qv7GM

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

AbobusTsb-31029.portmap.host:31029

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrackLauncherPass1234.exe
    "C:\Users\Admin\AppData\Local\Temp\CrackLauncherPass1234.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CrackLauncherPass1234.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CrackLauncherPass1234.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2008
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3634B9B2-1DCA-41D3-BB32-02C44C0BF7D0} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1388
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TOVTN3MZ7HFI7H2IUDO6.temp
    Filesize

    7KB

    MD5

    a3768b4d60d45ee79b7db6d71fed7c68

    SHA1

    40457e006e332f9f57c526e92fce366d605a7d7b

    SHA256

    c46e5ddd59bd2dbebb17c83d604d5c8112eb0324960267239b606036864967ed

    SHA512

    6e049177ae379b874fd5cc5d18718bb4ee41292add216793cac4ae7d040459afba2c8b5265d4f75248ff66a5a6a0b031e0e1add413d5ae02b02889403b341f43

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    73KB

    MD5

    fa0d41dc7ca9c40b5bd4ddc84ddcab86

    SHA1

    86e94ea9ecbcf30f187e68fb8c5afd6ee2891ba9

    SHA256

    35dc677cc4ded7c3ef15ed4130c13c23c62055f78161c2d93318113c2fd0de66

    SHA512

    6e4dbfd1edb207bb017da41864811d793f23bb032e0838b24cafaac41f51806333e67b6f69a18d12bc8ca08c6b533d56f9d287c464b445ead92e8bd49e7e5d13

    Download Submit

  • memory/908-31-0x000000001B3D0000-0x000000001B450000-memory.dmp

    Filesize

    512KB

    Download

  • memory/908-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/908-32-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/908-1-0x0000000000C40000-0x0000000000C58000-memory.dmp

    Filesize

    96KB

    Download

  • memory/908-37-0x000000001B3D0000-0x000000001B450000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1388-36-0x0000000000AA0000-0x0000000000AB8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1988-41-0x0000000000390000-0x00000000003A8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2260-8-0x00000000022D0000-0x00000000022D8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2260-7-0x000000001B690000-0x000000001B972000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2260-6-0x0000000002C00000-0x0000000002C80000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2864-14-0x000000001B670000-0x000000001B952000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2864-15-0x0000000002790000-0x0000000002798000-memory.dmp

    Filesize

    32KB

    Download