Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
08/03/2025, 19:30
General
-
Target
2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe
-
Size
238KB
-
MD5
bac16142016d690c8769d21668736653
-
SHA1
4b7c1ca4e7b8739c739980c0b830010a87ceff13
-
SHA256
7cd9183c01c3c913ea5ea3f0a9cfb0f9594bfae61e6582204786bc4d406614aa
-
SHA512
50659e8e0e05180ad0acb27b46cfbe7ccdbce8ba97f240b3e6c7e1084e8afaa0624fd1eff82b830c3eb25db45596f6a437bd0cd9ef9d2a3f83fb80f4d015437f
-
SSDEEP
6144:mDp5I4So24RJMMC1RK4/mUGGR5nvn/4eHZZ+cvlFq9yu6x8vTeVYNLjoqQkeDR2r:mDp5I4So24RJM11RK4/mUGGR5nvn/4eQ
Malware Config
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "2025-03-08_bac16142016d690c8769d21668736653_hiddentear" /tr "C:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exeC:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exeC:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exeC:\Users\Admin\AppData\Roaming\2025-03-08_bac16142016d690c8769d21668736653_hiddentear.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fde7cc81ed0c50e7ce18702102f19ace
SHA1e9f02b348fda9b22bb3999b4ebef4d366f153086
SHA25600ac4add3fbf73f31bdeb249969dddc68da554c9e9383ec524d63c64dc3f4b53
SHA51275bf55c4f619948f16e29f51008d026e7789eda82615f566b150d54f5769b64d7fe1a6ff8be458e2630be621c551183dfe272ce0a579024065cbc2b4b26f4bf5
-
Filesize
238KB
MD5bac16142016d690c8769d21668736653
SHA14b7c1ca4e7b8739c739980c0b830010a87ceff13
SHA2567cd9183c01c3c913ea5ea3f0a9cfb0f9594bfae61e6582204786bc4d406614aa
SHA51250659e8e0e05180ad0acb27b46cfbe7ccdbce8ba97f240b3e6c7e1084e8afaa0624fd1eff82b830c3eb25db45596f6a437bd0cd9ef9d2a3f83fb80f4d015437f
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
264KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB