Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
104b5d342b8c...86.exe
windows7-x64
94b5d342b8c...86.exe
windows10-2004-x64
94bb452a3de...a3.exe
windows7-x64
104bb452a3de...a3.exe
windows10-2004-x64
74bbf1f33d0...4d.exe
windows7-x64
84bbf1f33d0...4d.exe
windows10-2004-x64
84bc17871c1...64.exe
windows7-x64
104bc17871c1...64.exe
windows10-2004-x64
104be84836f6...c8.exe
windows7-x64
104be84836f6...c8.exe
windows10-2004-x64
104c2f38b994...d5.exe
windows7-x64
104c2f38b994...d5.exe
windows10-2004-x64
104c948e4226...26.exe
windows7-x64
104c948e4226...26.exe
windows10-2004-x64
104ca1d61a24...2e.exe
windows7-x64
104ca1d61a24...2e.exe
windows10-2004-x64
104cc3e6fe69...22.exe
windows7-x64
104cc3e6fe69...22.exe
windows10-2004-x64
104cf9706999...8e.exe
windows7-x64
104cf9706999...8e.exe
windows10-2004-x64
104d8cd82fa6...d5.exe
windows7-x64
104d8cd82fa6...d5.exe
windows10-2004-x64
104d947659fe...19.exe
windows7-x64
104d947659fe...19.exe
windows10-2004-x64
104dac62ad00...ec.exe
windows7-x64
104dac62ad00...ec.exe
windows10-2004-x64
104dde57eed0...7b.exe
windows7-x64
104dde57eed0...7b.exe
windows10-2004-x64
104e1fdde317...d3.exe
windows7-x64
104e1fdde317...d3.exe
windows10-2004-x64
104e248cce2f...a7.exe
windows7-x64
104e248cce2f...a7.exe
windows10-2004-x64
10Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:10 UTC
Behavioral task
behavioral1
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win7-20250207-en
Behavioral task
behavioral10
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win10v2004-20250314-en
General
-
Target
4dac62ad007ffed0e0d4b738af6da8ec.exe
-
Size
78KB
-
MD5
4dac62ad007ffed0e0d4b738af6da8ec
-
SHA1
91437886f46d83c6106497c42b18d977ebd77b4f
-
SHA256
042263c682b6bb02efb4d42de2b13ab4c56ef56ffb740ea2be36fce7dd61aba4
-
SHA512
7e1434e2989dc57a4d632e4c6983a76d34e1ca45ae2493ac917bbef4dbb1e360567abad32c25a670bb4b379b50c1b4483332ecfa7d8ace8ee2fd6cb80631732f
-
SSDEEP
1536:IbhBwtZA8wBpQzZkgBzWr7qxKGpbheZMrezOnxlh6+4xZxOwqofoFKP:IbhOWBpQzZr5W/qbAWSzGfd43xOwqof7
Malware Config
Extracted
xworm
127.0.0.1:4758
108.77.173.66:4758
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral25/memory/2948-1-0x0000000000950000-0x000000000096A000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2948 4dac62ad007ffed0e0d4b738af6da8ec.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
Remote address:208.95.112.1:80RequestGET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 5
Access-Control-Allow-Origin: *
X-Ttl: 12
X-Rl: 37
-
310 B 266 B 5 2
HTTP Request
GET http://ip-api.com/line/?fields=hostingHTTP Response
200