Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
09/03/2025, 22:01
General
-
Target
stage11.exe
-
Size
33KB
-
MD5
9bc1a11f74a4066c8ece952ebb3c3861
-
SHA1
babd4413a4f4993db464daa5de929ab71ad31062
-
SHA256
394fc6b474bc2f131764e3fa3faaa3d406a10baf2c0a6a6cd8b07e270ca6a47c
-
SHA512
03410b75092f42aecb80a336aa368bf45a28ef89e2c63438d5bd00688c9c2153987ff9f58702111a56f2911a70c8082e6c2d05154f56fad75c94c2fe80b49ecd
-
SSDEEP
384:7l+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Iku7:R+CD93W03v42JiB70lVF49jWOjhrb2
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
meowycatty.ddns.net:8843
Mutex
jRccj8SKwN7fQIlB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stage11.exe"C:\Users\Admin\AppData\Local\Temp\stage11.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB