Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2025, 21:11
Behavioral task
behavioral1
Sample
XClient77777.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
XClient77777.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
XClient77777.exe
Resource
win11-20250217-en
windows11-21h2-x64
General
-
Target
XClient77777.exe
-
Size
35KB
-
MD5
5ea0f5924111a1694b717407703b660f
-
SHA1
e9c88fbd4a5d00461c18cb44b2c222df45943e22
-
SHA256
31dfb42cde129b009abfa9dfa7ff5028df923c6fe87520f49cd33a3af14dccfb
-
SHA512
15aee130c32a50e40ff1347687741e32bb450074fd83288d515dd6ce2bb7047c093c89bb058b8e3226cd39d4ad5fc5e015b1c26286f11d217d9010e5485924fa
-
SSDEEP
768:jDMfF7zLKYs2Byj5zuddqLb9Fk9wmAO/hZ/y2p:jkF7HKYs/1Md8Fk9wmAO/Xq2p
Malware Config
Extracted
xworm
5.0
any-attraction.gl.at.ply.gg:27770
uSx0YbbkrTZOubR8
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/4184-1-0x0000000000060000-0x0000000000070000-memory.dmp family_xworm behavioral1/files/0x000c000000023bda-22.dat family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation XClient77777.exe Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation Hacked By Mikey -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hacked By Mikey.lnk XClient77777.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hacked By Mikey.lnk XClient77777.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hacked By Mikey.lnk Hacked By Mikey -
Executes dropped EXE 2 IoCs
pid Process 5852 Hacked By Mikey 5144 Hacked By Mikey -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hacked By Mikey = "C:\\Users\\Admin\\AppData\\Roaming\\Hacked By Mikey" XClient77777.exe Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hacked By Mikey = "C:\\Users\\Admin\\AppData\\Roaming\\Hacked By Mikey" Hacked By Mikey -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5124 schtasks.exe 2600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5724 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4184 XClient77777.exe Token: SeDebugPrivilege 5724 taskmgr.exe Token: SeSystemProfilePrivilege 5724 taskmgr.exe Token: SeCreateGlobalPrivilege 5724 taskmgr.exe Token: SeDebugPrivilege 5852 Hacked By Mikey Token: SeDebugPrivilege 5144 Hacked By Mikey -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe 5724 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4184 wrote to memory of 5124 4184 XClient77777.exe 93 PID 4184 wrote to memory of 5124 4184 XClient77777.exe 93 PID 5144 wrote to memory of 2600 5144 Hacked By Mikey 116 PID 5144 wrote to memory of 2600 5144 Hacked By Mikey 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient77777.exe"C:\Users\Admin\AppData\Local\Temp\XClient77777.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Hacked By Mikey" /tr "C:\Users\Admin\AppData\Roaming\Hacked By Mikey"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5124
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5724
-
C:\Users\Admin\AppData\Roaming\Hacked By Mikey"C:\Users\Admin\AppData\Roaming\Hacked By Mikey"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852
-
C:\Users\Admin\AppData\Roaming\Hacked By Mikey"C:\Users\Admin\AppData\Roaming\Hacked By Mikey"1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Hacked By Mikey" /tr "C:\Users\Admin\AppData\Roaming\Hacked By Mikey"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
35KB
MD55ea0f5924111a1694b717407703b660f
SHA1e9c88fbd4a5d00461c18cb44b2c222df45943e22
SHA25631dfb42cde129b009abfa9dfa7ff5028df923c6fe87520f49cd33a3af14dccfb
SHA51215aee130c32a50e40ff1347687741e32bb450074fd83288d515dd6ce2bb7047c093c89bb058b8e3226cd39d4ad5fc5e015b1c26286f11d217d9010e5485924fa
-
Filesize
789B
MD5943b67940d59347e9fe4d29fe1e70f4b
SHA1677cb2a165d24f0ca07f0cbe8a9a05b8d9bb698a
SHA2562bb7029576844c7d024220143921ad3ea888122397e3cb6b5183d5aa12a559f0
SHA5123df610e88e9d38d6d112968ef87b82610b32f05a50226d5e41a6ad0d4e0c7bbd2c2d10b4c8a8a4bd65afa6359da7d12fd1ecbc49d7df0a9e8eb397b187c82b4c