Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
144s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250218-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08/03/2025, 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
payload.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
payload.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
payload.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
9 signatures
150 seconds
General
-
Target
payload.exe
-
Size
209KB
-
MD5
e737f0619caaa10b2c2c04f88d8c723a
-
SHA1
81e77cd927098a8974e0ee96e77ed534fb181d85
-
SHA256
718ed0a3d6f82b36d5da2672c247c094362e616bf7f121756d00dc8a70371ecc
-
SHA512
1f91990eb0d002984e0963282ee83d16ac158327e55d0bf4a0cc00add261a4173c4f5dec4f857d65469235b6c47f63c6bed9a32d35a3ea0a2839c67e23454cc5
-
SSDEEP
3072:YV9qW1ZG0hVD+g7HII7qlnsf3zfK484WjOwIpa8:BA8GDv7oI2nQzRQ
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%ProgramData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/H3wFXmEi
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/3836-7-0x0000027A334D0000-0x0000027A334E6000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3836 payload.exe Token: SeDebugPrivilege 1104 taskmgr.exe Token: SeSystemProfilePrivilege 1104 taskmgr.exe Token: SeCreateGlobalPrivilege 1104 taskmgr.exe Token: 33 1104 taskmgr.exe Token: SeIncBasePriorityPrivilege 1104 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe 1104 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payload.exe"C:\Users\Admin\AppData\Local\Temp\payload.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104