Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Xvirus-Too...rus.py
windows7-x64
3Xvirus-Too...rus.py
windows10-2004-x64
3Xvirus-Too...up.bat
windows7-x64
1Xvirus-Too...up.bat
windows10-2004-x64
1Xvirus-Too...rt.bat
windows7-x64
1Xvirus-Too...rt.bat
windows10-2004-x64
1Xvirus-Too...t__.py
windows7-x64
1Xvirus-Too...t__.py
windows10-2004-x64
3Xvirus-Too...les.py
windows7-x64
3Xvirus-Too...les.py
windows10-2004-x64
3Xvirus-Too...mer.py
windows7-x64
3Xvirus-Too...mer.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ort.py
windows7-x64
3Xvirus-Too...ort.py
windows10-2004-x64
3Xvirus-Too...mer.py
windows7-x64
3Xvirus-Too...mer.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ker.py
windows7-x64
3Xvirus-Too...ker.py
windows10-2004-x64
3Xvirus-Too...ker.py
windows7-x64
3Xvirus-Too...ker.py
windows10-2004-x64
3Xvirus-Too...ner.py
windows7-x64
3Xvirus-Too...ner.py
windows10-2004-x64
3Xvirus-Too...ver.py
windows7-x64
3Xvirus-Too...ver.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ver.py
windows7-x64
3Xvirus-Too...ver.py
windows10-2004-x64
3Analysis
-
max time kernel
77s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 11:12 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Xvirus-Tools-1.7.1/Xvirus.py
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Xvirus-Tools-1.7.1/Xvirus.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Xvirus-Tools-1.7.1/setup.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Xvirus-Tools-1.7.1/setup.bat
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Xvirus-Tools-1.7.1/start.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Xvirus-Tools-1.7.1/start.bat
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Xvirus-Tools-1.7.1/util/__init__.py
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Xvirus-Tools-1.7.1/util/__init__.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
Xvirus-Tools-1.7.1/util/options/bypass_rules.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Xvirus-Tools-1.7.1/util/options/bypass_rules.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
Xvirus-Tools-1.7.1/util/options/channel_spammer.py
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
Xvirus-Tools-1.7.1/util/options/channel_spammer.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Xvirus-Tools-1.7.1/util/options/hypesquad_changer.py
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Xvirus-Tools-1.7.1/util/options/hypesquad_changer.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
Xvirus-Tools-1.7.1/util/options/mass_report.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Xvirus-Tools-1.7.1/util/options/mass_report.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
Xvirus-Tools-1.7.1/util/options/soundboard_spammer.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Xvirus-Tools-1.7.1/util/options/soundboard_spammer.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
Xvirus-Tools-1.7.1/util/options/token_bio_changer.py
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Xvirus-Tools-1.7.1/util/options/token_bio_changer.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
Xvirus-Tools-1.7.1/util/options/token_checker.py
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
Xvirus-Tools-1.7.1/util/options/token_checker.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
Xvirus-Tools-1.7.1/util/options/token_global_nicker.py
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Xvirus-Tools-1.7.1/util/options/token_global_nicker.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
Xvirus-Tools-1.7.1/util/options/token_joiner.py
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Xvirus-Tools-1.7.1/util/options/token_joiner.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
Xvirus-Tools-1.7.1/util/options/token_leaver.py
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Xvirus-Tools-1.7.1/util/options/token_leaver.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
Xvirus-Tools-1.7.1/util/options/token_pron_changer.py
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Xvirus-Tools-1.7.1/util/options/token_pron_changer.py
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
Xvirus-Tools-1.7.1/util/options/token_saver.py
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Xvirus-Tools-1.7.1/util/options/token_saver.py
Resource
win10v2004-20240221-en
General
-
Target
Xvirus-Tools-1.7.1/Xvirus.py
-
Size
8KB
-
MD5
fc57448db02026c736190b4ee77b572f
-
SHA1
18cb2d216814c9834f70f185eca3cde0e2c212d1
-
SHA256
67facff65be74557e19d5261402fdc42ed82715742b8365bea174a740b9453fa
-
SHA512
ce43c684f32d10c575677d630922f66e0de91d732fc7ff161b4290cfcf90b273579a09fe0847f3d51afcc0b175ff0e07c69351f303baa2d7d36a9a1b0040f619
-
SSDEEP
192:CGWZRZd7vnTNxTM/DTdkff9XxrcNqTf2BXsYEJv:30zlvnTNxTL9XxrcNqTA7Ex
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2576 OpenWith.exe
Processes
Network
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1C395BAEC5E46CA20A5D4F83C45F6D2F; domain=.bing.com; expires=Tue, 18-Mar-2025 11:12:38 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5DD7824140764C7BA0658F1A25978A4F Ref B: LON04EDGE0821 Ref C: 2024-02-22T11:12:38Z
date: Thu, 22 Feb 2024 11:12:38 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1C395BAEC5E46CA20A5D4F83C45F6D2F
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=XtGzfl46LWS5sLnDkBFVXKRukDb-yDPGPlzRLqTcbcU; domain=.bing.com; expires=Tue, 18-Mar-2025 11:12:38 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ADC402FC26A2406084CB7A04B6408661 Ref B: LON04EDGE0821 Ref C: 2024-02-22T11:12:38Z
date: Thu, 22 Feb 2024 11:12:38 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1C395BAEC5E46CA20A5D4F83C45F6D2F; MSPTC=XtGzfl46LWS5sLnDkBFVXKRukDb-yDPGPlzRLqTcbcU
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9CB262DF32454C91895337168DA9F553 Ref B: LON04EDGE0821 Ref C: 2024-02-22T11:12:39Z
date: Thu, 22 Feb 2024 11:12:38 GMT
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=tls, http22.0kB 9.2kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=671d638c763340efa51c527110f95208&localId=w:E314FD8B-EFD3-6710-D2FD-4A5236C803A9&deviceId=6966557285300211&anid=HTTP Response
204
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa