Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2025, 22:01
Behavioral task
behavioral1
Sample
stage11.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
General
-
Target
stage11.exe
-
Size
33KB
-
MD5
9bc1a11f74a4066c8ece952ebb3c3861
-
SHA1
babd4413a4f4993db464daa5de929ab71ad31062
-
SHA256
394fc6b474bc2f131764e3fa3faaa3d406a10baf2c0a6a6cd8b07e270ca6a47c
-
SHA512
03410b75092f42aecb80a336aa368bf45a28ef89e2c63438d5bd00688c9c2153987ff9f58702111a56f2911a70c8082e6c2d05154f56fad75c94c2fe80b49ecd
-
SSDEEP
384:7l+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Iku7:R+CD93W03v42JiB70lVF49jWOjhrb2
Malware Config
Extracted
Family
xworm
Version
5.0
C2
meowycatty.ddns.net:8843
Mutex
jRccj8SKwN7fQIlB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/1612-1-0x0000000000D30000-0x0000000000D3E000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5008 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1612 stage11.exe Token: SeDebugPrivilege 5008 taskmgr.exe Token: SeSystemProfilePrivilege 5008 taskmgr.exe Token: SeCreateGlobalPrivilege 5008 taskmgr.exe Token: 33 5008 taskmgr.exe Token: SeIncBasePriorityPrivilege 5008 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stage11.exe"C:\Users\Admin\AppData\Local\Temp\stage11.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5008