Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1090ed1454b8...38.exe
windows7-x64
1090ed1454b8...38.exe
windows10-2004-x64
1091570920da...cf.exe
windows7-x64
1091570920da...cf.exe
windows10-2004-x64
7915c452bf2...b6.exe
windows7-x64
10915c452bf2...b6.exe
windows10-2004-x64
10916cd92d3a...38.exe
windows7-x64
10916cd92d3a...38.exe
windows10-2004-x64
10916fbe67a7...e3.exe
windows7-x64
10916fbe67a7...e3.exe
windows10-2004-x64
1091cce1a9f4...6a.exe
windows7-x64
1091cce1a9f4...6a.exe
windows10-2004-x64
1091d2e3f758...f6.exe
windows7-x64
1091d2e3f758...f6.exe
windows10-2004-x64
1091d7fa8d89...52.exe
windows7-x64
1091d7fa8d89...52.exe
windows10-2004-x64
1091e6d47bd8...cc.exe
windows7-x64
791e6d47bd8...cc.exe
windows10-2004-x64
792105c7a3b...24.exe
windows7-x64
792105c7a3b...24.exe
windows10-2004-x64
7921421b7f5...09.exe
windows7-x64
10921421b7f5...09.exe
windows10-2004-x64
109221b9eea3...3c.exe
windows7-x64
19221b9eea3...3c.exe
windows10-2004-x64
1092324d5776...05.exe
windows7-x64
192324d5776...05.exe
windows10-2004-x64
1927cd0bd1a...b8.exe
windows7-x64
3927cd0bd1a...b8.exe
windows10-2004-x64
392efd55895...78.exe
windows7-x64
1092efd55895...78.exe
windows10-2004-x64
10932a9096cd...eb.exe
windows7-x64
10932a9096cd...eb.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:14
Behavioral task
behavioral1
Sample
90ed1454b881cba4ecd9b651325d4638.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
90ed1454b881cba4ecd9b651325d4638.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
916cd92d3ac28dded1335ac06764e138.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
916cd92d3ac28dded1335ac06764e138.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
916fbe67a7968d2b65d54ae3ce72f3e3.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
916fbe67a7968d2b65d54ae3ce72f3e3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
91cce1a9f4562b0cd73d60203cebb76a.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
91cce1a9f4562b0cd73d60203cebb76a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
91d7fa8d891f603b35c77da7fcc4c552.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
91d7fa8d891f603b35c77da7fcc4c552.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
91e6d47bd804e58a4e160993dfdfc3cc.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
91e6d47bd804e58a4e160993dfdfc3cc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
9221b9eea367a2434dacd850f7b30b3c.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
9221b9eea367a2434dacd850f7b30b3c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
927cd0bd1a26a2158a18e48e682ba3b8.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
927cd0bd1a26a2158a18e48e682ba3b8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
92efd55895cd60b5057f3fb06ad84c78.exe
Resource
win7-20250207-en
Behavioral task
behavioral30
Sample
92efd55895cd60b5057f3fb06ad84c78.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
932a9096cd16630970f2bdc5e6cb9aeb.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
932a9096cd16630970f2bdc5e6cb9aeb.exe
Resource
win10v2004-20250314-en
General
-
Target
916cd92d3ac28dded1335ac06764e138.exe
-
Size
39KB
-
MD5
916cd92d3ac28dded1335ac06764e138
-
SHA1
723a0815fe64380ccb2d5b3cc8dd4715cd0167cd
-
SHA256
328d960f3c75b7870f97ade069315809dd1649966cce248d85d64f191147da96
-
SHA512
349bee4b9192224122943633908dab1478ef8014202155b1be53115c291b480d3021af69f16623a8683b09bb3b680548b4ee751f90e90330b2baf8f9acd53195
-
SSDEEP
768:3F0D8dYqSKMY69IUGBhOq2MGoi4QX6U0XkdIyFZ89slrXJ6KOhhbu2:3Fw8dYqkY69IU4h4b8Q6U0XUFq9s5Z6D
Malware Config
Extracted
xworm
5.0
design-shipped.gl.at.ply.gg:2938
v6oCqftosMfufC9R
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral8/memory/4416-1-0x00000000005C0000-0x00000000005D0000-memory.dmp family_xworm behavioral8/files/0x000b0000000242ff-58.dat family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4776 powershell.exe 940 powershell.exe 5036 powershell.exe 2416 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation 916cd92d3ac28dded1335ac06764e138.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Calender.lnk 916cd92d3ac28dded1335ac06764e138.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Calender.lnk 916cd92d3ac28dded1335ac06764e138.exe -
Executes dropped EXE 3 IoCs
pid Process 3716 Windows Calender 3196 Windows Calender 4984 Windows Calender -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Calender = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Calender" 916cd92d3ac28dded1335ac06764e138.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5136 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4416 916cd92d3ac28dded1335ac06764e138.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2416 powershell.exe 2416 powershell.exe 4776 powershell.exe 4776 powershell.exe 940 powershell.exe 940 powershell.exe 5036 powershell.exe 5036 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4416 916cd92d3ac28dded1335ac06764e138.exe Token: SeDebugPrivilege 2416 powershell.exe Token: SeDebugPrivilege 4776 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 4416 916cd92d3ac28dded1335ac06764e138.exe Token: SeDebugPrivilege 3716 Windows Calender Token: SeDebugPrivilege 3196 Windows Calender Token: SeDebugPrivilege 4984 Windows Calender -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4416 wrote to memory of 2416 4416 916cd92d3ac28dded1335ac06764e138.exe 88 PID 4416 wrote to memory of 2416 4416 916cd92d3ac28dded1335ac06764e138.exe 88 PID 4416 wrote to memory of 4776 4416 916cd92d3ac28dded1335ac06764e138.exe 90 PID 4416 wrote to memory of 4776 4416 916cd92d3ac28dded1335ac06764e138.exe 90 PID 4416 wrote to memory of 940 4416 916cd92d3ac28dded1335ac06764e138.exe 92 PID 4416 wrote to memory of 940 4416 916cd92d3ac28dded1335ac06764e138.exe 92 PID 4416 wrote to memory of 5036 4416 916cd92d3ac28dded1335ac06764e138.exe 94 PID 4416 wrote to memory of 5036 4416 916cd92d3ac28dded1335ac06764e138.exe 94 PID 4416 wrote to memory of 5136 4416 916cd92d3ac28dded1335ac06764e138.exe 96 PID 4416 wrote to memory of 5136 4416 916cd92d3ac28dded1335ac06764e138.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\916cd92d3ac28dded1335ac06764e138.exe"C:\Users\Admin\AppData\Local\Temp\916cd92d3ac28dded1335ac06764e138.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\916cd92d3ac28dded1335ac06764e138.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '916cd92d3ac28dded1335ac06764e138.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Calender'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Calender'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Calender" /tr "C:\Users\Admin\AppData\Roaming\Windows Calender"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5136
-
-
C:\Users\Admin\AppData\Roaming\Windows Calender"C:\Users\Admin\AppData\Roaming\Windows Calender"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
C:\Users\Admin\AppData\Roaming\Windows Calender"C:\Users\Admin\AppData\Roaming\Windows Calender"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
C:\Users\Admin\AppData\Roaming\Windows Calender"C:\Users\Admin\AppData\Roaming\Windows Calender"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5efa4168b73a5e8ae56d49bcac4d67861
SHA1b3fe6b2d9fc05ad7892a2c8b96914764336b3067
SHA2567aab157fba3a543647a38cc8729ffb962a58cc2093d94566c9e68ff73d134dca
SHA512a1f305eac9c73c951f22e76f3904c1c6bb518b12d8a74bbea544c845f3d592e7915ec47d6531a3a4e669f6ab12311f3a632ff47a68f36370111d1c82cf8b6e99
-
Filesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
Filesize
944B
MD5e58749a7a1826f6ea62df1e2ef63a32b
SHA1c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA2560e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
SHA5124cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39KB
MD5916cd92d3ac28dded1335ac06764e138
SHA1723a0815fe64380ccb2d5b3cc8dd4715cd0167cd
SHA256328d960f3c75b7870f97ade069315809dd1649966cce248d85d64f191147da96
SHA512349bee4b9192224122943633908dab1478ef8014202155b1be53115c291b480d3021af69f16623a8683b09bb3b680548b4ee751f90e90330b2baf8f9acd53195