Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
08/03/2025, 22:26
General
-
Target
кряк/Nursultan.exe
-
Size
140KB
-
MD5
6b59fb1cb3b120b287335bc3d333ed29
-
SHA1
c0d2746fd8fa925fc2ccd50ca4f6bdd3edfd8d5a
-
SHA256
9e34d463a02bd29528a25cbf121e9b0d35f9032028eeb750259f672d0e51bb7b
-
SHA512
eb1a688ff6b6c7d7af66064662e3c76cab6ba6b02a35f4c26cd19d83905fc299ae7445338e5f1a56f101ab81eae883a3f9de628b07713fd472095877bd6fba1b
-
SSDEEP
1536:WvNtgwn3U49HFE9jfOjbmc1MXsb504lnkHggFvlO24:WvN6kHFE9jfOjaQMk04lnkHgsS
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:8067
Mutex
uevfZl7Tf1ThWFdr
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\кряк\Nursultan.exe"C:\Users\Admin\AppData\Local\Temp\кряк\Nursultan.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB