Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2.vbs
-
Size
156KB
-
Sample
240514-b39fhsef93
-
MD5
cc2682120b5da60396761ae1acaa7194
-
SHA1
6f3e932331c1a5f051d50ed9f5a40152946f06b5
-
SHA256
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2
-
SHA512
24e51481fbf2164190017c008edeb02f2e30d961ed1b9a4c02906340615ac1fcb28eb5ffa92867493a27196e4b1f5cdaa2ac2ffc5d83617768a6e0a2eded7776
-
SSDEEP
1536:B82qd99CObiNCocEW1aJK66n5yhtW0/5JpWn4ctIg0BfbUZlu9gISsRD:DqdY9JK6X/vcGg0Bfcc
Static task
static1
Behavioral task
behavioral1
Sample
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2.vbs
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
3.1
xmay8000.duckdns.org:8000
1xahivGykLCNnHwa
-
install_file
USB.exe
Targets
-
-
Target
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2.vbs
-
Size
156KB
-
MD5
cc2682120b5da60396761ae1acaa7194
-
SHA1
6f3e932331c1a5f051d50ed9f5a40152946f06b5
-
SHA256
c1c22fa37924cdd1c41c1b485b2686dbda7d7f9db5d314c40abfb840ab8950a2
-
SHA512
24e51481fbf2164190017c008edeb02f2e30d961ed1b9a4c02906340615ac1fcb28eb5ffa92867493a27196e4b1f5cdaa2ac2ffc5d83617768a6e0a2eded7776
-
SSDEEP
1536:B82qd99CObiNCocEW1aJK66n5yhtW0/5JpWn4ctIg0BfbUZlu9gISsRD:DqdY9JK6X/vcGg0Bfcc
Score10/10-
Detect Xworm Payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-