Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RuntimeBroker.exe
-
Size
77KB
-
Sample
240217-xcw86ahg9z
-
MD5
7f3d8bc2d995a6d0780aeb80c3172a82
-
SHA1
781de6ee7e83ce7d159031f16e9677d7aff91516
-
SHA256
4288137e125d257cce26bdabf57533f03f8aa7476ab6f3c33bc009d3a9f81df0
-
SHA512
a6997ecde20919abc259b37bd8352b79908e0a0aab6a78cb8293d676e1249af66deeffd8d545227b17513f725a22f0503fa321403cf3c4f40811f8d58cce87cd
-
SSDEEP
1536:N0A5d1cL+IvRpH4/NbbnjIvUG64OeTIOMbeeSTuX1kC47:NDq5pHyNb3MdTIOweeIK1kP7
Behavioral task
behavioral1
Sample
RuntimeBroker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RuntimeBroker.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
xworm
K1NGonTop-39501.portmap.io:39501
<Xwormmm>:1
-
Install_directory
%Public%
-
install_file
RuntimeBroker.exe
Targets
-
-
Target
RuntimeBroker.exe
-
Size
77KB
-
MD5
7f3d8bc2d995a6d0780aeb80c3172a82
-
SHA1
781de6ee7e83ce7d159031f16e9677d7aff91516
-
SHA256
4288137e125d257cce26bdabf57533f03f8aa7476ab6f3c33bc009d3a9f81df0
-
SHA512
a6997ecde20919abc259b37bd8352b79908e0a0aab6a78cb8293d676e1249af66deeffd8d545227b17513f725a22f0503fa321403cf3c4f40811f8d58cce87cd
-
SSDEEP
1536:N0A5d1cL+IvRpH4/NbbnjIvUG64OeTIOMbeeSTuX1kC47:NDq5pHyNb3MdTIOweeIK1kP7
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-